https://community.splunk.com/t5/Splunk-Search/Time-difference-for-the-transaction/m-p/84352#M182025 <P>Well, you need to check what is causing this problem - the functionality is there, so...</P> Tue, 09 Oct 2012 12:49:39 GMT Ayn 2012-10-09T12:49:39Z https://community.splunk.com/t5/Splunk-Search/Time-difference-for-the-transaction/m-p/84348#M182021 <P>I want to find the time difference between the transactions,display as a chart</P> <P>My data will look like this</P> <P>Mon Sep 24 11:00:30 CDT 2012,xxx,START</P> <P>Mon Sep 24 11:00:31 CDT 2012,xxx,COMPLETION: Succeeded</P> <P>so what i need is (11:00:30-11:00:31) is 01 seconds</P> <P>Plz Help</P> Tue, 09 Oct 2012 12:13:09 GMT https://community.splunk.com/t5/Splunk-Search/Time-difference-for-the-transaction/m-p/84348#M182021 splunkpoornima 2012-10-09T12:13:09Z https://community.splunk.com/t5/Splunk-Search/Time-difference-for-the-transaction/m-p/84349#M182022 <P>Have a look at the <CODE>duration</CODE> field which is created by the <CODE>transaction</CODE> command, it should be precisely what you need.</P> Tue, 09 Oct 2012 12:17:46 GMT https://community.splunk.com/t5/Splunk-Search/Time-difference-for-the-transaction/m-p/84349#M182022 Ayn 2012-10-09T12:17:46Z https://community.splunk.com/t5/Splunk-Search/Time-difference-for-the-transaction/m-p/84350#M182023 <P>I used the search command as<BR /> source="task"|transaction task_action startswith=START endswith=Succeeded|Table_time task_action duration</P> <P>90% of the result is coming correct ..<BR /> but for some case the result is not an exact difference</P> Mon, 28 Sep 2020 12:35:23 GMT https://community.splunk.com/t5/Splunk-Search/Time-difference-for-the-transaction/m-p/84350#M182023 splunkpoornima 2020-09-28T12:35:23Z https://community.splunk.com/t5/Splunk-Search/Time-difference-for-the-transaction/m-p/84351#M182024 <P>I used the duration also but since i got wrong results for some cases</P> Tue, 09 Oct 2012 12:39:33 GMT https://community.splunk.com/t5/Splunk-Search/Time-difference-for-the-transaction/m-p/84351#M182024 splunkpoornima 2012-10-09T12:39:33Z https://community.splunk.com/t5/Splunk-Search/Time-difference-for-the-transaction/m-p/84352#M182025 <P>Well, you need to check what is causing this problem - the functionality is there, so...</P> Tue, 09 Oct 2012 12:49:39 GMT https://community.splunk.com/t5/Splunk-Search/Time-difference-for-the-transaction/m-p/84352#M182025 Ayn 2012-10-09T12:49:39Z https://community.splunk.com/t5/Splunk-Search/Time-difference-for-the-transaction/m-p/84353#M182026 <P>You might check that your time extractions are correct. If Splunk's interpretation of each event's time is incorrect, that could lead to the duration field being incorrect.</P> Fri, 16 Aug 2013 19:25:20 GMT https://community.splunk.com/t5/Splunk-Search/Time-difference-for-the-transaction/m-p/84353#M182026 supersleepwalke 2013-08-16T19:25:20Z