Irule for getting total response time, server response time and server connection time

the total_time is not the upstream time. It is the time between the events HTTP_REQUEST and HTTP_RESPONSE_RELEASE

Right. Had to read that part again. I can definitely see where you're going with this, but let me offer up one theory. The CLIENT_ACCEPTED, LB_SELECTED, and SERVER_CONNECTED events are only going to be triggered ONCE per TCP session, while the HTTP events will potentially trigger multiple times within a single TCP session. You may notice that connection_time stays the same across multiple requests - an indication that it is probably being (statically) reused from the request that initiated the handshake. So it is then possible that the initial server side handshake could have taken longer than any subsequent HTTP request/response cycle - not the first one obviously, but one that happened after the first one but in the same TCP session.