Find time between first and second events grouped - efficiently

[noambz]

Hi,

I am getting events in the form of:

__time, app_name, action,udid

"2013-04-11 23:26:32","nxTomo HK V0.9","game_start","1234"

I wish to group them by udid and find the time in seconds between the first and second event,
even if there are more than 2 events in an group.
The rest of the events should be ignored.

Can someone help me do this efficiently?

[noambz · Accepted solution]

I tried this and it seems to work.

action=app_start | streamstats avg(_time) as prevendtime window=1 current=f global=false by udid | eval timegapsecs=abs(round(_time - prevendtime,0)) | reverse | dedup 1 udid

Can anyone comment on the efficiency or correctness of this?

[jcoates_splunk]

Hi, I think Example 6 here is what you want... http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Eval#Example_6

[noambz]

Not exactly.

Let's say I have 3 app starts. They will all be grouped together and the duration will measure the time between the 1st and 3rd.

If I use maxevents=2. Then the other event will be in a separate group which needs to be discarded somehow.