Calculations on 2 different fields from 2 separate logs, newbie here

[606866581]

Hi, I've got 2 log lines which look similar to this:

Thu Aug 08 16:45:01 2013 | Field1 : 25
Thu Aug 08 16:45:01 2013 | Field2 : 30

Does anyone know how to find Field3 which is (Field2-Field1)

I've tried:
| eval Field3=Field2-Field1 |

But because they're not from the same log line, Field3 is always null.
Any advice is appreciated!

[martin_mueller · Accepted solution]

Assuming the two events have the same timestamp and no other events with that timestamp exist, you can do this:

... | eventstats first(Field1) as f1 first(Field2) as f2 by _time | eval f3 = f2 - f1

[606866581]

Worked perfectly, Thanks!

[606866581]

Actually yes, the timestamp is guaranteed to be exactly the same

[martin_mueller]

Are they reliably group-able by timestamp? If not, how should Splunk guess which two lines to match up?

[606866581]

unfortunately these logs are pretty bare, they're not much longer than the example above ^

[martin_mueller]

Is there some kind of grouping field that Splunk can use to match two lines together?