https://community.splunk.com/t5/Splunk-Search/How-to-find-in-between-duration-between-three-transaction-event/m-p/472792#M133074 <P>Hi,</P> <P>How can I find in between duration between three transaction event? For example, the duration1 between mod1 and mod2, and duration2 between mod2 and mod3. My current query is taking a while because I'm appending two searches. how can I improve it<BR /> Ex:</P> <PRE><CODE>user type time user1 mod1 10:00 user1 mod2 11:00 user1 mod3 13:00 </CODE></PRE> <P>Expected result</P> <PRE><CODE>user durationMod1Mod2 durationMod2Mod3 user1 1 hour 2 hours </CODE></PRE> <P>Current code:</P> <P>base search ...</P> <PRE><CODE>| transaction user startswith=eval(status="mod1") endswith=eval(status="mod2") | rename duration as duration1 | append [base search ... | transaction user startswith=eval(status="mod2") endswith=eval(status="mod3") | rename duration as duration2 ] | stats values(duration1), values(duration1) by user </CODE></PRE> Fri, 14 Feb 2020 21:44:09 GMT limalbert 2020-02-14T21:44:09Z https://community.splunk.com/t5/Splunk-Search/How-to-find-in-between-duration-between-three-transaction-event/m-p/472792#M133074 <P>Hi,</P> <P>How can I find in between duration between three transaction event? For example, the duration1 between mod1 and mod2, and duration2 between mod2 and mod3. My current query is taking a while because I'm appending two searches. how can I improve it<BR /> Ex:</P> <PRE><CODE>user type time user1 mod1 10:00 user1 mod2 11:00 user1 mod3 13:00 </CODE></PRE> <P>Expected result</P> <PRE><CODE>user durationMod1Mod2 durationMod2Mod3 user1 1 hour 2 hours </CODE></PRE> <P>Current code:</P> <P>base search ...</P> <PRE><CODE>| transaction user startswith=eval(status="mod1") endswith=eval(status="mod2") | rename duration as duration1 | append [base search ... | transaction user startswith=eval(status="mod2") endswith=eval(status="mod3") | rename duration as duration2 ] | stats values(duration1), values(duration1) by user </CODE></PRE> Fri, 14 Feb 2020 21:44:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-in-between-duration-between-three-transaction-event/m-p/472792#M133074 limalbert 2020-02-14T21:44:09Z https://community.splunk.com/t5/Splunk-Search/How-to-find-in-between-duration-between-three-transaction-event/m-p/472793#M133075 <P>Can you post your expected output? I also don't see the field duration in your data, nor do i see it being calculated here.</P> Fri, 14 Feb 2020 21:54:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-in-between-duration-between-three-transaction-event/m-p/472793#M133075 arjunpkishore5 2020-02-14T21:54:26Z https://community.splunk.com/t5/Splunk-Search/How-to-find-in-between-duration-between-three-transaction-event/m-p/472794#M133076 <PRE><CODE>base search ... | stats range(eval(if(status="mod1" OR status="mod2" OR status="mod3", _time, NULL))) as duration by user </CODE></PRE> Fri, 14 Feb 2020 22:46:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-in-between-duration-between-three-transaction-event/m-p/472794#M133076 to4kawa 2020-02-14T22:46:16Z https://community.splunk.com/t5/Splunk-Search/How-to-find-in-between-duration-between-three-transaction-event/m-p/472795#M133077 <P>Expected result is added. Transaction command actually created duration.</P> Sun, 16 Feb 2020 14:05:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-in-between-duration-between-three-transaction-event/m-p/472795#M133077 limalbert 2020-02-16T14:05:00Z https://community.splunk.com/t5/Splunk-Search/How-to-find-in-between-duration-between-three-transaction-event/m-p/472796#M133078 <P>Thank you! This works for me.</P> <PRE><CODE>base search ... | stats range(eval(if(status="mod1" OR status="mod2" OR status="mod3", _time, NULL))) as duration1, range(eval(if(status="mod2" OR status="mod3", _time, NULL))) as duration2 by user </CODE></PRE> Sun, 16 Feb 2020 14:06:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-in-between-duration-between-three-transaction-event/m-p/472796#M133078 limalbert 2020-02-16T14:06:07Z