I am trying to find the timings between multiple calls under the same extracted field of InterchangeId. When using streamstats range(_time), I get the timing between the calls, however the first call in order of time has the total time and the last call has a 0 value. I am trying to determine how long it takes between each call in the correct order without it aggregating one of the calls to the total timing value.
Below is a screenshot of the results as well as the search. I appreciate any help with this!
@richgalloway Thank you! I was able to add window=2 to the search and verified that the timings look accurate after finding the total time and checking against each individual row's timing. For some reason window=1 resulted in all 0 results, but 2 worked as expected. Thanks again!