Right now, I have this pretty simple search for the single user:
| sort _time
| table _time x_page_name user duration
I've tried to expand this using transactions like this:
MAIN SEARCH STUFF user=*
[ transaction user
| eval earliest=info_max_time
| eval stime= round(_time-earliest,0)]
| sort stime
| table stime x_page_name user duration
But, alas, I have had no luck.
Any suggestions are appreciated. If you think of a better approach to solving this I would love to know!