Hey splunk community! I need to create a search query to find instances where the time between a "Cache set' log from my application and a "Cache miss" log is not equal to a certain value(The configured TTL), for any cache key. I've attempted starting with a particular key(sampleKey) but the end goal is to tabularize these results for all keys. Here's my attempt to calculate the time difference for a sampleKey, between the set and miss times : index= authzds-e2e* "setting value into memcached" "key=sampleKey" [search index=authzds-e2e* "Cache status=miss" "key=sampleKey" | stats latest(_time) as missTime ] | stats earliest(_time) as setTime| eval timeDiff=setTime-missTime My goal is to calculate the difference between consecutive set and miss events, key-wise (not earliest/latest as in the above query) ... View more