You can do something like (for the sake of the example I am going to assume your field names are Linked_Logon_ID and Logon_ID) ...|eval Shared_Logon_ID=case( searchmatch("Linked_Logon_ID") , Linked_Logon_ID , searchmatch("Logon_ID") , Logon_ID) | transaction Shared_Logon_ID ... Both types of events will now have the common field name and will be grouped together by transaction. Hope this helps. ... View more

Transaction can be a performance inhibitor, I always try to reduce the data as much as possible ahead of time to mitigate this (using =value, where, etc.). That being said, I don't have an immediate solution to handle this problem another way, perhaps investigate the other comment on this post. Best of luck. ... View more

Also I realized I messed up the indexing, it starts from 0 not 1 (-1 is still valid to index the last entry). Sorry for the confusion. ... View more

You can use something like ...|transaction <transaction_id_field> mvlist=t to group the events by their transaction ID. Once you've done that you can use mvindex to get the time of the desired event for each transaction. For example |eval received_time= mvindex(<your_time_field>, 1)| eval replying_time=mvindex(<your_time_field>,-1) | eval total_response_time = replying_time - received_time. This example would compute D-A, but the same can be done for B-A,C-B using their respective index in the transaction. You may need to play with commands like tonumber() and the time format to do the subtraction. Also, it doesn't look like you'll have this problem so I didn't mention it, but if your transactions are not grouped in chronological order for some reason, you can use mvfind() to better index within a transaction. If this is a problem for you I can post a more detailed explanation. ... View more