Sure, this can be done too. I'm posting a new answer because I can't comment from my workplace for some reason. To calculate times within a transaction, you should eval the times before initiating the transaction, eval your time differences within each transaction, then use stats to find the time differences average or whatever you need. For example:
index=citrix sourcetype="wts_log" | eval Start_Time=if(Status="STARTED",_time,null())
| eval Step_1_Time=if(Status="Step1_Complete",_time,null())
| eval Step_2_Time=if(Status="Step2_Complete",_time,null())
| eval Step_3_Time=if(Status="Step3_Complete",_time,null())
| eval Step_4_Time=if(Status="Step4_Complete",_time,null())
| eval Finish_Time=if(Status="FINISH",_time,null())
| transaction UserName host startswith="STARTED" endswith="FINISHED"
| eval Step_1_Completion=Step_1_Time-Start_Time
| eval Step_2_Completion=Step_2_Time-Start_Time
| eval Step_3_Completion=Step_3_Time-Start_Time
| eval Step_4_Completion=Step_4_Time-Start_Time
| stats avg(Step_1_Completion) as Step_1_Completion_Average, avg(Step_2_Completion) as Step_2_Completion_Average, avg(Step_3_Completion) as Step_3_Completion_Average, avg(Step_4_Completion) as Step_4_Completion_Average
The search is longer now, but you can figure all kinds of inter-transaction timing with this kind of search. Hope it helps!
... View more