The line crcSalt=/tmp/.csv.gz is incorrect please use (verbatium) crcSalt= <SOURCE> ... View more

Splunk doesn't do loops, searches work differently. Here's an approach, partly in pseudo-SPL: | inputlookup your_lookup_here ... format the HH:MM:SS time into actual epoch values ... | stats range(epoch_field) as duration values(type) as types by Channel That will compute the difference between the smallest and largest time for each Channel, assuming each channel has exactly one request and response type. The values() will give you a list of types present for that Channel, mostly for checking/debugging. ... View more