Delta time for each event for basic search?

[abzmhzsplunk]

If I run a simple search:
Index=*

It displays each event with columns as time, then the event.

Is there a way to configure Splunk also to display another column called "Delta Time" which shows time difference from previous event?

This will help to eyeball quickly the time gap.

Thanks.

[lguinn2]

Yes you can, although this can add quite a bit of overhead to your search, depending on the number of results. And the search "index=*" is also an expensive search, unless you are in a small environment or your timerange is very short.

index=*
| delta _time p=1 as delta_time
| eval delta_time = tostring(delta_time,"duration")
| table _time, delta_time, _raw

Notice that your delta time will always be negative, because Splunk shows the most recent events first.

(Updated to correct typo in line 3 of the search)

[abzmhzsplunk]

Thanks for posting the answer.

In the above posting, I removed line 3 which caused error.

index=* My_TXN_ID
| delta _time p=1 as delta_time
| table _time, delta_time, _raw

Now it works.

Is there a way to also display the sequence number, and show the message not as "_raw" but formatted as normal search result?

Thanks.

[abzmhzsplunk]

Ok, I know how to add sequence number.
How to format the message "_raw" as normal search display?

index=* My_TXN_ID
| delta _time p=1 as delta_time

|streamstats count as seq_num
| table seq_num _time, delta_time, _raw

[lguinn2]

I don't know what you mean by "normal search display."
_raw represents the entire event. It is unusual to use _raw in the table command. Instead, include a list of the fields of interest. I can't tell you what fields that would be, since it depends entirely on your data. But for example:

... | table seq_num _time delta_time host status message