I am dealing with log files which are structured as follows
TimeStamp=1 SessionHandle=1 SessionEvent=A
TimeStamp=2 SessionHandle=1 SessionEvent=B
TimeStamp=3 SessionHandle=1 SessionEvent=C
TimeStamp=4 SessionHandle=1 SessionEvent=D
TimeStamp=5 SessionHandle=1 SessionEvent=E
TimeStamp=6 SessionHandle=1 SessionEvent=F
TimeStamp=7 SessionHandle=1 SessionEvent=G
TimeStamp=8 SessionHandle=1 SessionEvent=H
TimeStamp=10 SessionHandle=2 SessionEvent=A
TimeStamp=11 SessionHandle=2 SessionEvent=B
TimeStamp=12 SessionHandle=2 SessionEvent=C
TimeStamp=13 SessionHandle=2 SessionEvent=D
TimeStamp=14 SessionHandle=2 SessionEvent=E
TimeStamp=15 SessionHandle=2 SessionEvent=F
TimeStamp=16 SessionHandle=2 SessionEvent=G
TimeStamp=17 SessionHandle=2 SessionEvent=H
I want to calculate duration between various events for each session
For ex: timediff between B & A, similarly H-A, H-D, A-F etc for each session separately and display results in single table
You may use streamstats to achieve this. Try something like this
Your Base search | streamstats window=1 current=f first(TimeStamp) as prevTimeStamp | eval duration=prevTimeStamp-TimeStamp
You can use transaction for this.
e.g. for calculating timediff between A & B, you can use something like
...|transaction SessionHandle startswith="SessionEvent=A" endswith="SessionEvent=B"