Time difference between 2 results, grouped by day

[cs97jb]

I have a search that returns two results per day (a job's log entry of when it started and when it ended). I want to be able to see the time difference between the two entries, grouped by day.

I'm a newbie to Splunk advanced searching so hopefully you can help.

My query is:

index=main ExportConfigInfo AND ("Message=Job started" OR "Message=Job completed")

[ITWhisperer]

Try something like this

index=main ExportConfigInfo "MessageJob started" OR "MessageJob completed"
| eval start=if(searchmatch("MessageJob started"),_time,null())
| eval end=if(searchmatch("MessageJob completed"),_time,null())
| bin _time span=1d
| stats min(start) as start, max(end) as end by _time
| eval diff=end-start
| eval difference=tostring(diff, "duration")