There are two elements to your question and likely a number of similar questions on the boards. What I understand the first part of your question to be is how do you get the duration between the first and last event. There are two general approaches. The first, and most common, is the transaction command which will output a duration field as seconds between the two timestamps. It might look something like this
sourcetype=foo | transaction startswith=<event1> endswith=<event2>
An alternative is a stats command where you are grouping the events by a common field. This might run a bit faster than transaction but transaction has more nuanced options.
sourcetype=foo <event1> OR <event2> | stats max(_time) as second_event min(_time) as first_event by <some field(s) the events have in common like maybe IP> | eval diff = second_event - first_event
The next piece is converting seconds to hours, min, sec etc. I have a generic case statement I tend to use - adjust to your particular needs. You don't need the round() function for each evaluation but I was young and dumb when I created it and what you don't see are the stats commands that typically come before this eval. I should probably make it even more generic /shrug.
eval elapsed_time = case(round(duration)<=60,round(duration)." sec", round(duration)<=3600, round(duration'/60,1)." min",round(duration)<=86400, round(duration/3600,1)." hours", round(duration)>86400, round(duration/86400,1)." days", 1=1, "fixme")
To put it all together then it might look like
sourcetype=foo | transaction startswith=<event1> endswith=<event2> | eval elapsed_time = case(round(duration)<=60,round(duration)." sec", round(duration)<=3600, round(duration'/60,1)." min", round(duration)<=86400, round(duration/3600,1)." hours", round(duration)>86400, round(duration/86400,1)." days", 1=1, "fixme") | table <fields of interest> duration elapsed_time
