how to calculate the difference in time for change in status of a transaction?

[sarvesh_11]

Hello Splunkers,

I want to calculate the time difference between the change in state of eventtype for each transation ID.

[ITWhisperer · Accepted solution]

Try something like this

| streamstats range(timestamp) as difference window=2 global=f by transactionid