How to common fields from two different events and calculate the diff between the start and end event group my main?

[Sekhar]

We have two events

Start event 

Index= x source= xtype | spath application | search application= x app " saved note" RCVD | rex field=" actionid"=(?<actionid>.*)", | Rex field =log " manid=(?<mandid>.*?)", | Rex field=log "bid=(?<bid>.*"     |  Rex field=  log " state=(?<state>.*" | Table _time bid,mandid,actionid,state

End event 

Index=y sourcetype=yytype source=y  "VALIDATION SUCESS" " msg got" | Rex field =msg " manid\:(?<mandid>.*?)", | Rex field=msg "actionid"\:(?<actionid>.*"  | Table _time manid actionid

Calculate different between start event and end event group by manid and count mandates exceeding different above 30sec

[richgalloway]

What have you tried so far and how have those efforts not met expectations?

[Sekhar]

start event | join [ end event] | stats min(_time) as start_time max(_time) as end_time values(actionid) as actionid values(batchid) as batchid by manid | eval duration = (end_time - start_time) | eval excessive = if(duration > 30, duration, null()) | stats count(excessive) as excess_count avg(excessive) as excess_avg by manid 

But sure about result getting correct or not

[richgalloway]

That query is a good start, but I'd use append rather than join for efficiency.

Only you can judge if the results are correct or not since you know the data.