I am assuming you have multiple values for the field in a single event (e.g. you've created a transaction or the event has multiple of that field already).
I'm also assuming it's a Unix epoch time, but this should work on any style of number. If you have a regular date string you need to do this on, you'll likely need to eval it using strptime(X,Y) to get it into that format.
So, if your field you want to perform the calculations on is a_time, you can do something like this.
... | eval a_start=min(a_time) | eval a_end=max(a_time)
| eval a_mycalculation=(a_end-a_start)/a_start
| table a_start, a_end, a_mycalculation
Free of charge I gave you a handy table, too, but you may not need that. 🙂
As you can see, doing the math was just like you wrote, so hopefully this will get you close enough to figure out the details on you own. If not, please paste in a couple of the raw events you need to work with and perhaps expound on the requirements just a tad more and we can see what we can do!
