index=_internal |head 2 | fields _raw _time | streamstats count | eval _raw=if(count=1,"{id: 1 , executor: \"executor1\" , timestamp:2020-07-16T02:02:02.566}","{id: 1 , executor: \"executor2\" , timestamp:2020-07-16T02:02:02.570}") | rename COMMENT as "the logic" | rex max_match=0 "(?<fieldname>\w+):\s?(?<value>\S+)(}| )" | eval _raw=mvzip(fieldname,value,"=") | kv | eval _time=strptime(timestamp,"%FT%T.%3N") | fields - fieldname value | delta _time as time_diff | fillnull time_diff | table id executor timestamp time_diff | rename executor as "executors" ,timestamp as logtime ,time_diff as "time difference" ... View more