calculate duration between events and show events with specific duration

[sarit_s]

Hello

i have a list of events and a fields called ClientDateTime 
i want to show the events the their ClientDateTime is 5s between one event to another
how can i do it ?

[richgalloway]

More information would be helpful, but is the general idea.  First, convert ClientDateTime into epoch form (using strptime).  Sort the events by the converted value.  Then use streamstats to compute the difference between adjacent events.  Finally, use where to filter out undesired values.

index=foo ClientDateTime=*
| eval ClientDT = strptime(ClientDateTime, "<<insert appropriate format string>>")
| sort + ClientDT
| streamstats window=2 range(ClientDT) as duration
| where duration > <<some-value>>

[sarit_s]

this is what i tried to do 

sourcetype=clientlogs AND Mode=Real AND Action="OpenPositionRequest" AND Request_Data_View_CurrentTradingMode="REGULAR" 
| eval ClientDT = strptime(ClientDateTime, "%Y-%m-%dT%H:%M:%S.%3NZ")
| sort + ClientDT
| streamstats window=2 range(ClientDT) as duration
|table ClientDT, duration

and here are the results :

how can i check if duration between events is 5s ?

[richgalloway]

The duration field value is in seconds.  Use the where command to filter for a specific value.

sourcetype=clientlogs AND Mode=Real AND Action="OpenPositionRequest" AND Request_Data_View_CurrentTradingMode="REGULAR" 
| eval ClientDT = strptime(ClientDateTime, "%Y-%m-%dT%H:%M:%S.%3NZ")
| sort + ClientDT
| streamstats window=2 range(ClientDT) as duration
| where duration = 5.000000
|table ClientDT, duration