You are correct, technically this operation could be completed in the parser by way of the collectAndSetAttrFromAnotherEvent function.Example from IronportMailParser
<when test="$ironportMailMID = $AnotherEvent.ironportMailMID">
In your case, you would want to retrieve the last time the interface went up or down and calculate the time between the two events. So you would want to use a function like calculateMSec once you assign the event receive time from the other event to a temp variable.
<when test='$eventType IN "PH_DEV_MON_INTF_OPER_DOWN_TO_UP,PH_DEV_MON_INTF_OPER_DOWN_TO_UP"'>
<collectAndSetAttrFromAnotherEvent AnotherEventType="PH_DEV_MON_INTF_OPER_DOWN_TO_UP OR PH_DEV_MON_INTF_OPER_DOWN_TO_UP">
<when test="$intfName = $AnotherEvent.intfName">
This example code is untested. It is only provided as an example. Please use at your own risk.
Word of advice
Be careful using this technique. It will force the parser to keep an index of all matching event types in memory. That said, the collectAndSetAttrFromAnotherEvent function is widely used in the default Windows parsers. I would just monitor the memory utilization of phParser on any collectors (or your Supervisor) that are parsing events.