There's probably a better function to use for this, but I think it could be done with an eval and where (I think anyway)...
I need to calculate the time difference between two events WHERE the status value is different. i.e;
event details status _time event 1 2 2019-03-25 00:01:00 event 2 3 2019-03-25 00:31:00
I tried this, but it failed;
| eval time1=_time(where (like status="2")
If there is something common between the events like a
transaction_id you can use the 'transaction' statement, which calculates you a duration in ms.
...your search| transaction tx_id |eval dur_sec=round((duration/1000) ,0)
If you provide some more relevent data I can expand my example to fit your use case.
I didnt think about 'transaction', I'll take a look at that. Regarding data, I'm using the rule_id of an event taken from the enterprise security macro 'incident_review', which is common between the two events;
rule_id status AssignementTime
0FF72D78 2 1552985974.388964
0FF72D78 3 1552986403.234565