You will need a common value in the two types of events to correlate events. For example, if each pair has a unique transaction ID, you can do | stats values(Resp_time) as Resp_time values(Req_time...
See more...
You will need a common value in the two types of events to correlate events. For example, if each pair has a unique transaction ID, you can do | stats values(Resp_time) as Resp_time values(Req_time) as Req_time by transaction_id
| eval Resp_time - Req_time Alternatively, if you have some other ways to determine a pairing, e.g., the two always happen within a deterministic interval, e.g., request comes in at 5 minute into the hour, a unique response is sent within the hour and NO other request would come in during the same hour, you can use that as criterion. There may be other conditions where you would use transaction. Unless you give us the exact condition, mathematically there is no solution.