2 timestamp, the rest identical, how calculate duration ?

[splunkLPN]

tim:2019-01-18 10:27:54,id:bee236
tim:2019-01-18 10:38:07,id:bee236
tim:2019-01-21 09:27:09,id:thierry403
tim:2019-01-21 09:37:21,id:thierry403

cherry on the cake : the duration is near 10 min. So I will search bots who made a second try in time between 595 and 605secs.
If tools on frequency could be more practical or efficient all solutions are welcome 🙂
thx for your help

[splunkLPN]

simple and efficient

[nickhills · Accepted solution]

try this:

[your search|transaction id|eval dur_seconds=round((duration/1000),0)|table _time id dur_seconds