@RobertEttinger80 ,
Try and verify against your data
"your search"
|sort transactionID,lastUpdateTime
|streamstats current=f window=1 last(lastUpdateTime) as prev by transactionID,type
|eval diff=lastUpdateTime-prev|fillnull value=0 diff
|eventstats avg(eval(if(status=="Created",diff,null()))) as Created
,avg(eval(if(status=="Processing",diff,null()))) as Processing
,avg(eval(if(status=="Held",diff,null()))) as Held
,avg(eval(if(status=="Completed",diff,null()))) as Completed
by type
|fields - diff,prev
You may replace eventstats with stats if you want to display only the avg.
... View more