OK, thank you both! A different set of eyes with a different set of experience and knowledge behind them helped immensely! While neither answer was the one I needed, they both helped to give me new things to think through. More searching then found the key, which was found here: http://splunk-base.splunk.com/answers/3651/calculate-diff-between-two-entries-in-a-transaction mvindex can do what I need once I've made the transaction. Right now, again awfully messy and in need of much cleanup, is the complete code. host=VNX | rex "Uptime: (?P \d+\s)" | rex "days, (?P \d+:\d+:\d+.\d+)" | rex "FAR_(?P [^_]+)" | eval rt2=trim(rd).":".rt |eval realtime=strptime(rt2, "%j:%H:%M:%S.%N") | transaction repl_name startswith="starting Incremental copy" endswith="completing Incremental copy" | eval begintime=mvindex(realtime,0) | eval endtime=mvindex(realtime,1) |eval realduration=endtime-begintime | fields duration,repl_name,realtime,begintime,endtime,realduration So, in a rather convoluted form, I pull out the fields I need with the regular expressions (oh, I added back in the hundredths of a second), eval them into something unified so they can be converted to something that Splunk's math works on well. Then create transactions out of those. Using mvindex, set a begintime and endtime via the different indexes into the transaction, then do a simple subtraction... I now have duration=1 <-- Notice these aren't right. realduration=0.120000 <-- but LOOK! begintime=1369133669.370000 endtime=1369133669.490000 realtime=1369133669.370000 realtime=1369133669.490000 repl_name=Source Mirror DS07 and duration=0 <-- again, I won't belabor the obvious realduration=0.140000 <-- Wonderful. begintime=1369133428.730000 endtime=1369133428.870000 realtime=1369133428.730000 realtime=1369133428.870000 repl_name=Source Mirror DS07 And bonus - the solution won't be bothered by reboots of the storage processors, because they're only used in calculating the difference. (Or, will be as I clean things up). ... View more