I'm looking for comparing the boot time for machines with FastBoot enabled vs themselves (or others) when FB was disabled. For that, I'm looking at "On/Off Transition - Standby/Resume Duration - Resume from Standby(s) - Target State = shutdown". My idea is to build a query that will compare these events with events from "On/Off Transition - Standby/Boot Duration - Computer Startup(s)".
Any other suggestion? If I'm on the right track, any hint on how I can cross these 2 sourcetypes to build my query?