Thanks, the version with streamstats works! Thanks a lot! ... View more

Thanks. I tried that, too, but it does the "splitting" by device one step too late. I would like to calculate the diff by device, so I would like something like ... delta _time by device So if I have these events: 2019-02-20 8:00:00 deviceA 2019-02-20 8:00:10 deviceB 2019-02-20 8:00:20 deviceA 2019-02-20 8:00:30 deviceB The search would result in mean/average time diffs of 10s for both, deviceA and deviceB. What I really would like to have would be 20s, as the events of the respective devices are 20s apart. ... View more

It was just random numbers... I can get the diff without respecting the devices by using this search index=device_events | sort - _time | delta _time AS timeDeltaS | eval timeDeltaS=toString(abs(timeDeltaS),"duration") | table _time device timeDeltaS which gives me something like this: _time device timeDeltaS 2019-02-19 10:46:09 111 2019-02-19 10:46:09 111 00:00:00 2019-02-19 10:46:08 112 00:00:01 2019-02-19 10:45:47 112 00:00:21 2019-02-19 10:44:47 112 00:01:00 2019-02-19 10:43:56 135 00:00:51 2019-02-19 10:43:47 112 00:00:09 2019-02-19 10:42:47 112 00:01:00 2019-02-19 10:41:47 112 00:01:00 2019-02-19 10:40:47 112 00:01:00 2019-02-19 10:40:40 135 00:00:07 2019-02-19 10:40:40 135 00:00:00 2019-02-19 10:40:39 135 00:00:01 2019-02-19 10:40:38 135 00:00:01 2019-02-19 10:40:38 135 00:00:00 2019-02-19 10:40:38 135 00:00:00 2019-02-19 10:40:38 135 00:00:00 2019-02-19 10:40:38 135 00:00:00 2019-02-19 10:40:38 135 00:00:00 2019-02-19 10:40:38 135 00:00:00 2019-02-19 10:40:37 135 00:00:01 2019-02-19 10:40:37 135 00:00:00 2019-02-19 10:40:37 135 00:00:00 2019-02-19 10:40:37 135 00:00:00 2019-02-19 10:40:06 135 00:00:31 2019-02-19 10:40:06 135 00:00:00 2019-02-19 10:40:06 135 00:00:00 2019-02-19 10:40:05 135 00:00:01 2019-02-19 10:40:05 135 00:00:00 ... View more