Hello everyone, I am currently developing a use case in which I have the below info: Username User Status User Code Time of Event per User Status update user A 0 0 1 1 xxxxx 2021-11-13 22:22:15 2021-11-13 23:40:09 2021-11-13 23:45:09 2021-11-13 23:50:09 user B 0 1 yyyyy 2021-11-13 22:40:09 2021-11-13 22:50:09 user A 0 1 1 ggggg 2021-11-13 22:50:09 2021-11-13 22:55:09 2021-11-13 22:58:09 I would like to find for each user the time difference between the timestamps of the first occurrence of status 0 and then the first occurrence of status 1. So based on the above table, I would like to extract the timestamp of 2021-11-13 22:22:15 for User Status 0 and the timestamp 2021-11-13 23:45:09 for User Status 1 for the user A. So my search query so far looks like it: | my index | sort UserStatus | transaction mvlist=true Username UserStatus | search eventcount >1 | UserStatus =0 and UserStatus=1 Any help will be much appreciated! Thanks
... View more