Time difference between 2 events

[manas]

I have 2 events :

Event 1 :

Timestamp A  UserID:ABC  startevent 

Event 2: 

Timestamp B  ID:ABC  endevent

I want to find time difference between start event and end event . In first event field is named "UserID" and in second event field is named "ID" .These two fields holds the value of the user for which start and subsequent end event is generated.

How can i get time difference here ? To use transaction i need a shared field .When i use transaction like below:

| transaction userId startswith=(event="startevent") endswith=("endevent") maxevents=2 , i get very few results .

[richgalloway]

You have a common field, just not a common name.  That's easy to fix using the coalesce function.

index=foo (UserID=* OR ID=*)
| eval commonID=coalesce(UserID, ID)
| stats min(_time) as startTime, max(_time) as endTime, values(*) as * by commonID
| eval diff=endTime - startTime

[manas]

Thanks .Used coalesce and transaction to get the data.