Example Gravwell anko script for calculating the time difference between entries in nanoseconds.

timeDiff.anko

# Example Gravwell anko script for calculating the time difference between entries in nanoseconds.
# Example usage to view the ms between entries might look like this:
#   tag=syslog sort by time asc | anko timeDiff | eval setEnum("ms", toFloat(timeDiff)/1000000.0) | table ms
# Note: `sort by time` is required to ensure proper ordering. Gravwell is time-indexed but for sub-granular differences
#   in time, order is not guaranteed. This is what enables distributed pipeline execution.
# Note: This script is uploaded as a resource called "timeDiff" in the above query example
# Further docs about Gravwell scripting can be found at https://dev.gravwell.io/docs/#!search/anko/anko.md

var lastTime = 0

func Process() {
  ns=1000000000*TIMESTAMP.Sec+TIMESTAMP.Nsec
  if lastTime == 0 {
    lastTime = ns
    return false
  }
  diff = ns-lastTime
  lastTime = ns
  setEnum("timeDiff", diff)
  return true
}