Answer by warren for Comparing Two Splunk Events To See Which One Is Larger

Sans sample data, something like the following will probably work:

index=crowdstrike sourcetype=crowdstrike:device:json falcon_device.hostname=* falcon_device.reduced_functionality_mode=yes
| stats max(_time) as yestime by falcon_device.hostname
| append
    [| search index=crowdstrike sourcetype=crowdstrike:device:json falcon_device.hostname=* falcon_device.reduced_functionality_mode=no
    | stats max(_time) as notime by falcon_device.hostname ]
| stats values(*) as * by falcon_device.hostname
| eval elapsed_seconds=yestime-notime

from User warren – Stack Overflow https://stackoverflow.com/questions/74351588/comparing-two-splunk-events-to-see-which-one-is-larger/74364838#74364838
via IFTTT