Compute time offset of each event compared to the transaction start

[esflavio]

In my situation I have "Web Requests" events, which I group in transactions with the following search:

sourcetype="WEB Request" 
| eval request_date=_time
| transaction user maxpause=10m startswith="logged in" mvlist="request_date"

I now have every request's absolute date, in order. And I would like to compute a multi valued field that would represent the offset of each request date compared to the session date.

Basically, if the field was not multivalued, I could complete the search with something like:

| eval request_time_offset=request_date - _time

But the field is multivalued, and I am not sure how to proceed.

[wpreston]

I'm not quite sure how to make it a multivalued field on the transaction, but here's one way you can calculate the time offset for each part of your transaction. You'll need another field that differentiates each part of the transaction, like a user's action or request. For purposes of this example, I'll call that field "Request":

sourcetype="WEB Request"  
| eval request_date=_time 
| transaction user maxpause=10m startswith="logged in" mvlist="request_date,Request"
| eval SplitField=mvzip(request_date,Request)
| mvexpand SplitField
| rex field=SplitField "(?<Request>[^,]+),(?<Request>.*)"
| eval ElapsedTime=request_date-_time
| table user Request request_date _time ElapsedTime

[esflavio]

@martin_mueller: I want to compute statistics on, for example, how late in a session a given page is accessed, to better model the users' behavior.

[martin_mueller]

What are you ultimately trying to achieve?