Is there any way to pre-calculate the difference between two fields and keep this delta as a new field for future searches?

[mohitab]

Data:

 departure_time1, departure_time2, arrival_time1, arrival_time2 

All the fields are in string.

My searches evaluate (departure_time2 - departure_time1) & (arrival_time2 - arrival_time1 ) to calculate time spans to add two new fields.

 departure_time1, departure_time2, arrival_time1, arrival_time2, departure_span, arrival_span

All my searches are based on filters/ranking on departure_span and arrival_span. The queries are originating from a Web app.

Question:
Is there any way in which I can pre-calculate these fields and keep them for future searches?

[rsennett_splunk]

You can move those "eval" calculations to the sourcetype... and then your two additional fields will always be there. check out the doc for props.conf and look for "EVAL" directive. Or you can do it through the GUI: settings>fields>calculated fields.

EVAL-<fieldname> = <eval statement>
* Use this to automatically run the <eval statement> and assign the value of the output 
  to <fieldname>. This creates a "calculated field."
* When multiple EVAL-* statements are specified, they behave as if 
  they are run in parallel, rather than in any particular sequence.  
  For example say you have two statements: EVAL-x = y*2 and EVAL-y=100. In this case, "x" 
  will be assigned the original value of "y * 2," not the value of "y" after it is set to 100.
* Splunk processes calculated fields after field extraction and field aliasing but before 
  lookups. This means that:
        * You can use a field alias in the eval statement for a calculated field.
        * You cannot use a field added through a lookup in an eval statement for a calculated
          field.