https://community.splunk.com/t5/Splunk-Search/Nested-Transaction-Time/m-p/58697#M14384 <P>Due to various cross references, I am forced to use nested transactions. In other words, I group several events into a transaction, and then I group several of those transactions in yet another transaction. And it works the way I want it to, except...</P> <P>The time of a transaction is the same as the time of the first event. So the duration of the last transaction is calculated as the difference between the starttime of the first transaction and the starttime of the last transaction.</P> <P>In stead, I need the difference between the starttime of the first transaction and the endtime of the last transaction.</P> <P>How would I go about doing this?</P> Mon, 10 Jun 2013 14:43:46 GMT vanaepi 2013-06-10T14:43:46Z https://community.splunk.com/t5/Splunk-Search/Nested-Transaction-Time/m-p/58697#M14384 <P>Due to various cross references, I am forced to use nested transactions. In other words, I group several events into a transaction, and then I group several of those transactions in yet another transaction. And it works the way I want it to, except...</P> <P>The time of a transaction is the same as the time of the first event. So the duration of the last transaction is calculated as the difference between the starttime of the first transaction and the starttime of the last transaction.</P> <P>In stead, I need the difference between the starttime of the first transaction and the endtime of the last transaction.</P> <P>How would I go about doing this?</P> Mon, 10 Jun 2013 14:43:46 GMT https://community.splunk.com/t5/Splunk-Search/Nested-Transaction-Time/m-p/58697#M14384 vanaepi 2013-06-10T14:43:46Z https://community.splunk.com/t5/Splunk-Search/Nested-Transaction-Time/m-p/58698#M14385 <P>Don't have a splunk in front of me right now, but I'm guessing something like this might work (adding the <CODE>duration</CODE> of the last sub-transaction to the <CODE>duration</CODE> of the 'parent')</P> <PRE><CODE>... | transaction X | eventstats latest(duration) as latest_dur by X | transaction Y | eval dur = duration+latest_dur </CODE></PRE> <P>Hope this helps,</P> <P>K</P> Mon, 10 Jun 2013 15:27:31 GMT https://community.splunk.com/t5/Splunk-Search/Nested-Transaction-Time/m-p/58698#M14385 kristian_kolb 2013-06-10T15:27:31Z https://community.splunk.com/t5/Splunk-Search/Nested-Transaction-Time/m-p/58699#M14386 <P>Yep it did the trick. Thanks!</P> Mon, 10 Jun 2013 15:31:16 GMT https://community.splunk.com/t5/Splunk-Search/Nested-Transaction-Time/m-p/58699#M14386 vanaepi 2013-06-10T15:31:16Z