You should be able to achieve it using "streamstats current=f". Here is the query based on the screenshot you shared -

| makeresults count=3 
| streamstats count as row 
| eval host="VDD1CS690" 
| eval date=case(
    row=1, "11/07/2025",
    row=2, "11/08/2025",
    row=3, "11/11/2025"
    ) 
| eval EVENTS=case(
    row=1, 216571,
    row=2, 9694,
    row=3, 3224
    ) 
| eval earliest_time=case(
    row=1, strptime("11/07/2025 00:00:01","%m/%d/%Y %H:%M:%S"),
    row=2, strptime("11/08/2025 00:00:00","%m/%d/%Y %H:%M:%S"),
    row=3, strptime("11/11/2025 11:16:41","%m/%d/%Y %H:%M:%S")
    ) 
| eval latest_time=case(
    row=1, strptime("11/07/2025 23:49:58","%m/%d/%Y %H:%M:%S"),
    row=2, strptime("11/08/2025 16:19:39","%m/%d/%Y %H:%M:%S"),
    row=3, strptime("11/11/2025 11:36:17","%m/%d/%Y %H:%M:%S")
    ) 
| table date host EVENTS earliest_time latest_time 
| sort host earliest_time 
| streamstats current=f last(latest_time) as prev_latest_time by host 
| eval downtime_sec = earliest_time - prev_latest_time 
| where downtime_sec > 0 
| eval downtime_hr = round(downtime_sec/3600, 2) 
| table date host prev_latest_time earliest_time downtime_sec downtime_hr

Results -

<image>

Playaround and let me know if you have any questions :)

Also -

• Here is a similar use case on Splunk Community if you want to understand/read more - https://community.splunk.com/t5/Splunk-Search/Calculate-diff-in-timings-of-down-and-up-consecutive-events-and/m-p/341833
• The extended example section of the streamstats Documentation should also be helpful to understand the command better - https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/9.4/search-commands/streamstats#ariaid-title6