Time difference within a transaction command

[tbrown]

I have a search that uses the transaction:

| transaction startswith=<...> endswith=<...>

 Command to group it into certain events I want to see. How would I search this even further to get the time difference between each event in this transaction and then graph these time differences to a line/bar graph with the events/hosts on X-axis and time on y-axis. There are no specific fields for each event that I want to use to calculate the time difference, I only want to show the time difference between each and every raw log in this transaction.

[richgalloway]

The duration field shows the time difference between the first and last events in the transaction. To get the deltas between individual events you'll have to parse the transaction.

[tbrown]

@richgalloway 

What would that command look like then? I have been trying to parse the transactions but haven't been able to find a working command that calculates the delta times.