https://community.splunk.com/t5/Getting-Data-In/How-to-display-time-stamp-in-each-line-on-transaction/m-p/177960#M35671 <P>I'd suggest capturing the times you are interested in before the transaction into a different field. Like so:</P> <PRE><CODE>&lt;base search&gt; | eval ack_sent_time = if(like(_raw,"%GetAckNak Sent%"),_time,nullif(1,1)) | eval ack_recv_time = if(like(_raw,"%GetAckNak Recv%"),_time,nullif(1,1)) | transaction ... </CODE></PRE> <P>This will store the _time in a field called ack_sent_time only if the event contains "GetAckNak Sent", and will store the _time in a field called ack_recv_time only if the event contains "GetAckNak Recv". Otherwise these fields will be NULL.</P> <P>This will allow you to do things like:</P> <PRE><CODE>... | stats latest(ack_sent_time) earliest(ack_recv_time) by &lt;field&gt; </CODE></PRE> <P>To get the last sent time, and the first recieved time. </P> <P>Hope this helps.</P> Mon, 28 Sep 2020 18:03:34 GMT aholzer 2020-09-28T18:03:34Z https://community.splunk.com/t5/Getting-Data-In/How-to-display-time-stamp-in-each-line-on-transaction/m-p/177959#M35670 <P>1</P> <PRE><CODE>0/21/14 13:17:08.747 SERIAL ZPIMXTerminal.Send Start 10/21/14 13:17:08.747 SERIAL SerialComClass:****NOTICE: Serial Port cleared OK 10/21/14 13:17:08.809 SERIAL GetAckNak Sent: [00] 10/21/14 13:17:08.840 WLL-EX CCTX_POS_GET_TenderTypeStatus = 0 10/21/14 13:17:08.919 SERIAL SerialComClass:****NOTICE: Serial Port cleared OK 10/21/14 13:17:08.919 SERIAL Send Msg() &gt; 10/21/14 13:17:08.981 SERIAL GetAckNak Recv: [00] 10/21/14 13:17:09.090 WLL-EX CCTX_OS_GET_TypeStatus = 0 10/21/14 13:17:09.090 SERIAL SerialComClass:**NOTICE: Serial Port cleared OK 10/21/14 13:17:09.153 SERIAL GetAckNak Recv: [00] 10/21/14 13:17:09.262 SERIAL SerialComClass:**NOTICE: Serial Port cleared OK 10/21/14 13:17:08.747 SERIAL ZPIMXTerminal.Send Start </CODE></PRE> <P>in above log.. i formed a transaction using "transaction startswith="ZPIMXTerminal.Send Start" endswith="ZPIMXTerminal.Send Start"</P> <P>i wanted to display time stamp in below 2 two lines </P> <PRE><CODE>10/21/14 13:17:08.809 SERIAL GetAckNak Sent: [00] 10/21/14 13:17:09.153 SERIAL GetAckNak Recv: [00] </CODE></PRE> <P>if I specify _time its giving me only the start time of the transaction </P> Fri, 31 Oct 2014 15:20:33 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-display-time-stamp-in-each-line-on-transaction/m-p/177959#M35670 hemanath_ofc 2014-10-31T15:20:33Z https://community.splunk.com/t5/Getting-Data-In/How-to-display-time-stamp-in-each-line-on-transaction/m-p/177960#M35671 <P>I'd suggest capturing the times you are interested in before the transaction into a different field. Like so:</P> <PRE><CODE>&lt;base search&gt; | eval ack_sent_time = if(like(_raw,"%GetAckNak Sent%"),_time,nullif(1,1)) | eval ack_recv_time = if(like(_raw,"%GetAckNak Recv%"),_time,nullif(1,1)) | transaction ... </CODE></PRE> <P>This will store the _time in a field called ack_sent_time only if the event contains "GetAckNak Sent", and will store the _time in a field called ack_recv_time only if the event contains "GetAckNak Recv". Otherwise these fields will be NULL.</P> <P>This will allow you to do things like:</P> <PRE><CODE>... | stats latest(ack_sent_time) earliest(ack_recv_time) by &lt;field&gt; </CODE></PRE> <P>To get the last sent time, and the first recieved time. </P> <P>Hope this helps.</P> Mon, 28 Sep 2020 18:03:34 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-display-time-stamp-in-each-line-on-transaction/m-p/177960#M35671 aholzer 2020-09-28T18:03:34Z