How to get the Maximum and Minimum time difference between the events

[ibob0304]

I have events which are in this format, where the time in the event is the _time.

8/11/2017 1:26:17 PM|Thread Id: 4756|Audit|machine1|event details
8/11/2017 2:13:33 PM|Thread Id: 4756|Audit|machine1|event details

I am trying to find the Max time, Min time between the events for that particular day. Suppose if I have 100 events and one event logged at 10am and next event logged at 11am, if that is the max delay time for that day? then it would show 1hr or 60mins. Similarly to the minimum events delay. It would be great if there is average time as well.

[woodcock · Accepted solution]

Like this:

...
| streamstats current=t window=2 range(_time) AS duration BY host 
| stats min(duration) AS Min max(duration) AS Max avg(duration) AS Avg BY host

[somesoni2]

With assumption that you're selecting same type of events but for different machines, try like this

your current search
| sort _time machine
| streamstats current=f window=1 values(_time) as prev_time by machine
| eval duration=_time-prev_time 
| stats min(duration) as Min max(duration) as Max avg(duration) as Avg by machine

[ibob0304]

Machines are same on each event. it gave me Max as 912 seconds and Woodcock query gave me 1214 seconds. 1214 seems to be correct.