How do you calculate time difference between multiple events that aren't in chronological order?

[puneetkharband1]

I have 6 events. Each one has a timestamp, and I have extracted the time of each into a new field using eval. But now, I am not able to create timedifference between event6-event1 or event4-event3 as per my needs.

I do not want to use the transaction command as I need to write multiple searches, and I am trying to solve this in search.

I am at a point where my last seach line is

| table Fourm_step_1_Time Fourm_step_2_Time Fourm_step_3_Time Fourm_step_4_Time Fourm_step_5_Time Fourm_step_6_Time

results are
0 0
0 0
0 0
0 0
0 123435453
1234545433 0
so on
@somesoni2

[ehollima]

When I am looking for time skews I use the following (credit to Hunter for the SPL)

index= earliest=-1m latest=+24h
| stats latest(_time) AS time by host
| eval now=now()
| eval offset=time-now
| eval time1=strftime(time,"%F - %T")
| eval now1=strftime(now,"%F - %T %Z")
| eval offset1=tostring(offset,"duration")
| convert ctime(time), ctime(now)
| table host offset offset1 time now now1 time1