First of all, your sample events don't make sense: your "first event" has a timestamp after all of the other events that "it caused" and your 12 events only have 11 timestamps listed (worst of all, the one that is not there is the most important one, the one that you desire). You should install the Windows TA so that your field extractions are automatic. I say this all the time: sow us your sample events (you were close but not all the way there), and a mockup of your desired final output. Then we can help.
... View more