https://community.splunk.com/t5/Splunk-Search/Need-Help-to-find-duration-of-transaction/m-p/103049#M26620 <P>Hi sanyonhhh</P> <P>the <A href="http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Transaction">transaction</A> command should provide you with a field called <CODE>duration</CODE> which is time in seconds for your transaction. But, it could be a floating point value for partial seconds if you have subseconds in your timestamps.</P> <P>you can use <A href="http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Eval">eval</A> to create a human readable time out of it like this</P> <PRE><CODE>| eval myTime=tostring(duration,"duration") </CODE></PRE> <P>hope this helps ...</P> <P>cheers, MuS</P> Thu, 17 Oct 2013 06:50:30 GMT MuS 2013-10-17T06:50:30Z https://community.splunk.com/t5/Splunk-Search/Need-Help-to-find-duration-of-transaction/m-p/103048#M26619 <P>Query used:</P> <P>index=[server]| transaction Extract startswith="Value Extract Starting." endswith="extraction completed."</P> <P>Log Result:</P> <P>1 » 10/4/13 11:39:58.000 PM<BR /><BR /> 2013-10-04T19:39:58 Extract STATUS Value Extract Starting.</P> <P>2013-10-04T19:40:02 Extract STATUS extraction completed. </P> <P>2 » 10/4/13 11:10:15.000 PM<BR /><BR /> 2013-10-04T19:10:15 Extract STATUS Value Extract Starting. </P> <P>2013-10-04T19:10:21 Extract STATUS extraction completed.</P> <P>Need to find the time difference in a transaction for start and end line. Time is present in both the lines. <BR /> Eg: From the first event i should get time differnce from 2013-10-04T19:39:58 and 2013-10-04T19:40:02 and should plot it as x-axis day and y-axis time difference.</P> Thu, 17 Oct 2013 05:48:59 GMT https://community.splunk.com/t5/Splunk-Search/Need-Help-to-find-duration-of-transaction/m-p/103048#M26619 sanyonhhh 2013-10-17T05:48:59Z https://community.splunk.com/t5/Splunk-Search/Need-Help-to-find-duration-of-transaction/m-p/103049#M26620 <P>Hi sanyonhhh</P> <P>the <A href="http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Transaction">transaction</A> command should provide you with a field called <CODE>duration</CODE> which is time in seconds for your transaction. But, it could be a floating point value for partial seconds if you have subseconds in your timestamps.</P> <P>you can use <A href="http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Eval">eval</A> to create a human readable time out of it like this</P> <PRE><CODE>| eval myTime=tostring(duration,"duration") </CODE></PRE> <P>hope this helps ...</P> <P>cheers, MuS</P> Thu, 17 Oct 2013 06:50:30 GMT https://community.splunk.com/t5/Splunk-Search/Need-Help-to-find-duration-of-transaction/m-p/103049#M26620 MuS 2013-10-17T06:50:30Z