We used this to produce a distribution of how long our sessions last. We print the median, average, and maximum session length based on the first and last occurrence of a given JSESSIONID. We also filter out those sessions less than ten seconds in length, to eliminate skew. If you need to view it differently, change the value accordingly.
host=cmhlpecomweb* sourcetype=access* | rex mode=sed field=_raw "s/\t/~/g" | eval tmp=split(_raw,"~") | eval jsessionid = mvindex(tmp,14) | transaction jsessionid | stats sum(duration) AS session_time by jsessionid | where session_time > 10 | stats median(session_time),avg(session_time),max(session_time)