Durations for Individual Events after grouping them together

[cmerriman]

I have strings of individual events that can be grouped together by a person's unique ID. What I need to figure out is how to get the duration of each of those events by each person and each screen they view, since it doesn't come back in the data. Here is my query so far:

sourcetype=mysource |sort _time (a)|stats list(_time) as Time list(ScreenId) as ScreenName by uniqueId

What comes back:

uniqueId    Time        ScreenName
 12345      1400054039      Screen1
            1400054065      Screen2
            1400054076

My next step would be to figure out how to add a field (duration) making Screen1 being 26 seconds and Screen 2 being 11 seconds. Screen1 is calculated from the duration on Screen2-duration on Screen1 and Screen2 is calculated based on the Null line (140054076)-duration on Screen2.

Any ideas?

[somesoni2 · Accepted solution]

Try this

sourcetype=mysource | sort -_time | streamstats current=f window=1 first(_time) as prevTime by uniqueId | eval duration=tostring(prevTime-_time, "duration") | stats list(_time) as Time list(ScreenId) as ScreenName list(duration) as Duration by uniqueId

[cmerriman]

That is PERFECT!