Connection time delta of a replication session, filter source and destination by connection id

[kisfoldik]

Hi! I would like to create a chart for connection time delta of a replication session, filter source and destination by connection id.
The basic search is :
index=log-3155-prod* eventtype=fwdldap-all-prod-hosts sourcetype="ldap-infra:access" laas_appId="ldap-infra/prod/ldap_FWD_PROD" "cn=replication manager"

One example connection is "conn=478597"

[04/Jul/2017:04:00:03 -0400] conn=478597 op=-1 msgId=-1 - closed.
[04/Jul/2017:04:00:03 -0400] conn=478597 op=8 msgId=-1 - closing from 10.99.67.108:57901 - U1 - Connection closed by unbind client -
[04/Jul/2017:04:00:03 -0400] conn=478597 op=8 msgId=9 - UNBIND
[04/Jul/2017:03:55:02 -0400] conn=478597 op=7 msgId=8 - RESULT err=0 tag=120 nentries=0 etime=0.001000
[04/Jul/2017:03:55:02 -0400] conn=478597 op=7 msgId=8 - EXT oid="1.3.6.1.4.1.42.2.27.9.6.6"
[04/Jul/2017:03:55:02 -0400] conn=478597 op=6 msgId=7 - RESULT err=0 tag=120 nentries=0 etime=0.001000
[04/Jul/2017:03:55:02 -0400] conn=478597 op=6 msgId=7 - EXT oid="1.3.6.1.4.1.42.2.27.9.6.1"
[04/Jul/2017:03:54:04 -0400] conn=478597 op=5 msgId=6 - RESULT err=0 tag=120 nentries=0 etime=0.000000
[04/Jul/2017:03:54:04 -0400] conn=478597 op=5 msgId=6 - EXT oid="1.3.6.1.4.1.42.2.27.9.6.6"
[04/Jul/2017:03:54:04 -0400] conn=478597 op=4 msgId=5 - RESULT err=0 tag=120 nentries=0 etime=0.000000
[04/Jul/2017:03:54:04 -0400] conn=478597 op=4 msgId=5 - EXT oid="1.3.6.1.4.1.42.2.27.9.6.1"
[04/Jul/2017:03:50:57 -0400] conn=478597 op=3 msgId=4 - RESULT err=0 tag=120 nentries=0 etime=0.001000
[04/Jul/2017:03:50:57 -0400] conn=478597 op=3 msgId=4 - EXT oid="1.3.6.1.4.1.42.2.27.9.6.6"
[04/Jul/2017:03:50:57 -0400] conn=478597 op=2 msgId=3 - RESULT err=0 tag=120 nentries=0 etime=0.001000
[04/Jul/2017:03:50:57 -0400] conn=478597 op=2 msgId=3 - EXT oid="1.3.6.1.4.1.42.2.27.9.6.1"
[04/Jul/2017:03:50:57 -0400] conn=478597 op=1 msgId=2 - RESULT err=0 tag=101 nentries=1 etime=0.001000
[04/Jul/2017:03:50:57 -0400] conn=478597 op=1 msgId=2 - SRCH base="" scope=0 filter="(objectclass=*)" attrs="supportedcontrol supportedextension moddnenabledsuffixes"
[04/Jul/2017:03:50:57 -0400] conn=478597 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0.001000 dn="cn=replication manager,cn=replication,cn=config"
[04/Jul/2017:03:50:57 -0400] conn=478597 op=0 msgId=1 - BIND dn="cn=replication manager,cn=replication,cn=config" method=128 version=3
[04/Jul/2017:03:50:57 -0400] conn=478597 op=-1 msgId=-1 - fd=78 slot=78 LDAP connection from 10.99.67.108:57901 to 10.98.68.160

expected output.
Source ----------------------destination---------------connection_time
10.99.67.108:57901------10.98.68.160---------------9.46 s

Your help is really appreciated!

[kisfoldik · Accepted solution]

index=log-3155-prod* eventtype=fwdldap-all-prod-hosts sourcetype="ldap-infra:access" laas_appId="ldap-infra/prod/ldap_FWD_PROD"
| eval timeFromBIND=if(match(_raw,".BIND."),_time,NULL)
| eventstats first(timeFromBIND) as timeFromBIND by conn
| eval diff=_time-timeFromBIND
| rex field=_raw "from (?.) to (?.)"
| stats first(_time) as connTime first(timeFromBIND) as timeFromBIND first(diff) as diff by source destination conn
| fields - diff - conn - timeFromBIND | rename connTime to connTime_in_sec | sort - connTime_in_sec

--------the source-destination is fine with this command, but doesn't give the time I need plus the format is weird.. ..any idea?