how to get the average time for latest event and previous event

[remoharish]

I am looking for a solution to show for every latest event time and previous event time average duration (and the time span between them). Please help me to get this sorted out ( duration time : 19/06/2017 14:03:23.000 - 19/06/2017 14:03:21.000 = 0.2 min).

Latest event:

19/06/2017
14:03:23.000

<[H8C8B5E4487854A2] Request sent

Previous Event:

19/06/2017
14:03:21.000

<[H8C8B5E4487854A2] Request sent

[cmerriman]

use streamstats. http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Streamstats

something like this:

...|sort 0 transaction _time
|streamstats window=1 current=f values(_time) as prevTime count as order by transaction
|eval deltaTime=_time-prevTime
|eval avgTime=(_time+prevTime)/2
|eventstats max(order) as maxOrder by transaction
|where maxOrder=order