How to tell if event is within X seconds (both forwards/backwards) of another event

[duckware]

Using 'delta' I am able to figure this out, but in one time direction.  Now I need the other time direction.

In the current event, I essentially need to get the answer to: Is there another event within X seconds (both forwards and backwards) of the current event.

Is there a way to do this?

[duckware · Accepted solution]

I figured out a way (for my usage case).

In my case, I just needed to mark events with X seconds of another event.  In one direction, this can be done with delta.  But then using sort to reverse direction, and running another delta gets the other direction.

So when events E1 and E2 are with 5 seconds of each other, running a delta one direction marks E2 as being within 5 seconds (of E1). That leaves E1 not marked.  But then sort to reverse direction of the events and delta again then marks E1 as being within 5 seconds (of E2).

[bowesmana]

@duckware 

Calculating deltas can be done with delta, as you have discovered or either of these

| autoregress _time as t p=1

| streamstats window=2 current=t range(_time) as r

the first will put _time into the next event and you can do your own calcs and the second does the calc itself.

However, to get the opposite direction, you'll have to reverse the data, so any of these commands can do the calculations, either with | reverse or | sort _time

I don't believe Splunk can do event 'lookahead' to get the value of an event later in the stream to calculate a delta to store in the current event.