Hello Splunkers,
I want to calculate the time difference between the change in state of eventtype for each transation ID.
Try something like this
| streamstats range(timestamp) as difference window=2 global=f by transactionid
Try something like this
| streamstats range(timestamp) as difference window=2 global=f by transactionid