Hey @sdk32, welcome to Splunk! Great question — and you’re definitely on the right track with the stats command. To calculate time differences directly within your stats aggregation, you can use streamstats or mvzip to pair timestamps, then subtract them. For example: your_search | stats list(executor) as executors, list(_time) as logtime by id | eval diff = mvzip(logtime, mvindex(logtime, 1, mvcount(logtime)-1)) | mvexpand diff | eval time_difference = round(strptime(mvindex(split(diff, ","), 1), "%Y-%m-%dT%H:%M:%S.%3N") - strptime(mvindex(split(diff, ","), 0), "%Y-%m-%dT%H:%M:%S.%3N"), 3) This approach aligns each timestamp with the next one and calculates the time gap between them, even if the number of executors changes dynamically. If you’re experimenting with Delta Executor or other automation tools to analyze Splunk logs, this method also integrates well for tracking execution steps and performance timing. Give it a try — it’s a clean way to visualize sequential timing differences! ... View more