Splunk Search

how to calculate duration between events

Path Finder

Hi All,

i have a events as mentioned below.

02/04/2019 19:58:01 this is from A4: message from something
02/04/2019 19:31:01 this is from A3: message from something
02/04/2019 19:22:01 this is from A2: message from something
02/04/2019 19:20:01 this is from A1: message from something

i would like to calculate time difference/duration between events like A1 to A2, A2 to A3, A3 to A4 and etc..could you please help on this.

0 Karma

SplunkTrust
SplunkTrust

are the events always follow one another? meaning, calculate duration between consecutive events?
any common field and or value/s to work with?

0 Karma