I have two time fields in a single event that I need to calculate the difference between and then display said difference in a table. The two fields and time formats are below: Time Created - Wed, 18 Dec 2019 19:23:56 -0500 Time Assigned - Wed, 18 Dec 2019 19:36:00 -0500 I would also like to then display the average of the difference for the other events, for example, if I have 10 events, I'd like the average time of the 10 differences. Thanks in advance. ... View more

Do any experienced Splunkers know what needs to be changed to my query below in order to create a TimeSpan Line Chart over say the past 30 days for counts of the four Severity levels created by the Eval command? index=myIndex source=mySource host=myHost sourcetype=mySourceType | stats count(eval(severity="0" OR severity="1" OR severity="2")) as Low count(eval(severity="3" OR severity="4" OR severity="5")) as Medium count(eval(severity="6" OR severity="7" OR severity="8")) as High count(eval(severity="9" OR severity="10")) as Critical | table Low Medium High Critical | transpose | rename column as Severity "row 1" as Count I have attached a screenshot and instead of the values on the right-hand side being 1 - 10, I'd like them to be Low, Medium etc... Thanks in advance ... View more