It's a matter of switching the way you think about it. Splunk's search language can do a lot, the tough part is finding the right commands to transform your data in a way you want to see it.
It's a little hard to give exact searches without knowing what your data looks like, but as a simple example, you could narrow your search to only show the ack release expire data. Then sort the results by host and time to see the timestamps of when each occurred. So assuming that you have the type of event in maybe an action field then something like
[your base search] (action="dhcpack" OR action="dhcprelease" OR action="dhcpexpire") | sort host ip _time | table host ip _time action
And if that looks correct/helpful, you might be able to use autoregress and/or delta to get the time difference between those events. Or you might be able to use eval and/or some multi-value commands/functions to combine/break events up until you see what you've transformed the result set into exactly what you're looking for.
So the answer is yes, it probably can be done. But it's going to be a little more involved than just going back and adding a timestamp unfortunately. If you share some of the actual data, we might be able to help you come up with the search you're looking for.
