Average time in multivalue field

[Walter_Oesch]

Hello
I have a two multivalue fields: poiMv (point of interest) and timeMv as a result of a transaction command. Both Mv-fields have the same size. Same index have corresponding values. poiMv holds the place an event occurred, timeMv the corresponding time.  poiMv holds non unique values, e.g. [start nonrelevant end nonrelevent nonrelevant start end nonrelevant start nonrelevant end].   Now I want to find the time differences of all successiv start and end events. Out of these time differences, I want to calculate the mean value. 

The mean value along with other values should then be presented in a table

Conceptually, the query should looks like this:
| index=myIndex
| where filter
| transaction correlationField mvlist="poiMv timeMv " 
| "find successiv start end pairs in poiMv, calculate time difference, take the mean"

| eval meanStartEnd = ....
| table column1 column2 meanStartEnd 

Any help is welcomed.

[ITWhisperer]

First suggestion would be to not use transaction - there are other ways of correlating events whilst maintaining time order, from which you can determine time difference and averages.

This would be easier to answer if you could provide some sample anonymised events so we can see what you are dealing with and set up some suggested solutions based on your (dummy) data.

[Walter_Oesch]

Thank you for your reply. I managed to find a solution. I use transaction to correlate events with different keys (in the pseudo code example only one field was used).