@cbiraris there are a number of ways of doing this, but it depends on what you want to end up with. I am assuming that the event _time field denotes your time - if not, then parsing your time field...
See more...
@cbiraris there are a number of ways of doing this, but it depends on what you want to end up with. I am assuming that the event _time field denotes your time - if not, then parsing your time field using strptime() is needed first. A couple of examples below showing you stats and streamstats usage. Using stats you can collect your events together like this, assuming you have some kind of correlation ID that can group the events together. | makeresults count=4
| streamstats c
| eval _time=now() - (c * 60) - (random() % 30)
| eval EventID="ID:".round(c / 2)
| fields - c
``` Calculate the gap ```
| stats range(_time) as r by EventID If you have a number events a simple example of streamstats will just calculate the difference between two events like this, which generates 4 random timed events and calculates the difference between each pair | makeresults count=4
| streamstats c
| eval _time=now() - (c * 60) - (random() % 30)
| fields - c
| eval Event=mvindex(split("Start,End",","),(c - 1) % 2)
``` Calculate the gap ```
| streamstats reset_after="Event=\"End\"" range(_time) as gap