Splunk query to find previous requests from different ip - splunk

Question

Suppose I've got the following log entries:
timestamp ip path
1668603956000 1.1.1.1 /some/path
1668603955000 2.2.2.2 /some/path
1668603954000 2.2.2.2 /some/other/path
1668603953000 3.3.3.3 /some/path
1668603952000 3.3.3.3 /some/other/path
1668603951000 4.4.4.4 /some/path
1668603950000 5.5.5.5 /some/path
I want to end up with a table that shows for ip=2.2.2.2, the ip from the previous request to the same path but with a different IP.
Expected results:
L.time R.time R.ip R.path
1668603954200 1668603954400 3.3.3.3 /some/path
1668603954300 1668603954600 4.4.4.4 /some/other/path
What I've tried:
source=my_log
| where ip = "2.2.2.2"
| table path, ip, _time
| join type=inner left=L right=R usetime=true earlier=true where L.path = R.path [
| where L.ip != R.ip
]
| table L._time, R._time, R.ip, R.path
But this does not give me any tabular results. I get raw events back, but the join doesn't seem to be working.

Answer 1

You seem to be trying to write SQL, but in SPL
I suggest starting here for how to change your approach - https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SQLtoSplunk
That said, I believe this will get you toward your goal:
index=ndx sourcetype=srctp ip=* path=*
| fields path ip _time
| fields - _raw
| sort 0 path -_time +ip
| streamstats reset_on_change=true current=true latest(_time) as tick by path ip
| eval tick=strftime(tick,"%c")
| stats count by path ip tick
| fields - count