How to group two field values into separate fields?

[bofasplunkguy]

I am working with data that is shared/backed up by two separate hosts. Each userID is linked to two hosts. When there are data issues (server outages, etc), a certain error on the host is triggered. I need to find out when the error is triggered for BOTH hosts at the same time. The error may be triggered every 5 minutes, so I need a table showing each userID, the two hosts that map to that user, and each timestamp that is within 5 seconds (due to latency timestamp may not match exactly).

Therefore, I believe I somehow need to separate the two hosts into separate fields, but am not sure the best way to do this.
The psuedo code would look like:

for each userID{
   if (host1 != host2 && abs(host1.timestamp-host2.timestamp) <= 5 && host1.error==host2.error){
         return (userID, host1,  host2, timestamp) 
   }
}

Is there a way in Splunk that I can generate this table by comparing timestamps of the two hosts that are connected to the userID?