You have not explained how you use stats to obtain each event's send and receive time. Judging from your high level data representation, what you really want is session duration (sessioId1, sessionId2, ...) grouped by event type (A, B, C, ...). If that is the case, indeed stats provides a cheap method. For simplicity, I further assume that the session IDs are in the same series, i.e., the same ID will not appear in more than one event types. There are ways to workaround this limitation, but it is just nuance.
You also have not explained what kind of chart you are looking for. Here is an example of time chart for average session duration for each type.
base search | rex "event (?<eventType>\w+)"
| stats min(_time) as _time max(_time) as end by sessionId eventType
| eval duration = end - _time
| timechart avg(duration) by eventType
(The above also assume that "event A", "event B", etc., appears literally like that so a regex can extract event type. You'll have to find your own way to extract this if that's not the case.) If there is a chance that session IDs overlap between event types, the simplest way to deal with it is to redefine session ID by sticking event type to session ID to form a new ID that is unique, e.g., | eval sessionId = eventType.sessionId .
... View more
