https://community.splunk.com/t5/Splunk-Search/Is-the-duration-field-always-in-seconds-transaction-command/m-p/30560#M6200 <P>Greetings everyone,<BR /> I just want to verify that the transaction generated duration field is always in seconds. it doesn't say definitively in the transaction guide. The examples below allude to it being in seconds, but I'm not entirely sure. Any advice would be helpful, thanks!</P> Wed, 07 Dec 2011 20:01:31 GMT msarro 2011-12-07T20:01:31Z https://community.splunk.com/t5/Splunk-Search/Is-the-duration-field-always-in-seconds-transaction-command/m-p/30560#M6200 <P>Greetings everyone,<BR /> I just want to verify that the transaction generated duration field is always in seconds. it doesn't say definitively in the transaction guide. The examples below allude to it being in seconds, but I'm not entirely sure. Any advice would be helpful, thanks!</P> Wed, 07 Dec 2011 20:01:31 GMT https://community.splunk.com/t5/Splunk-Search/Is-the-duration-field-always-in-seconds-transaction-command/m-p/30560#M6200 msarro 2011-12-07T20:01:31Z https://community.splunk.com/t5/Splunk-Search/Is-the-duration-field-always-in-seconds-transaction-command/m-p/30561#M6201 <P>Yes, it is always seconds. But, it could be a floating point value for partial seconds if you have subseconds in your timestamps.</P> Wed, 07 Dec 2011 20:30:02 GMT https://community.splunk.com/t5/Splunk-Search/Is-the-duration-field-always-in-seconds-transaction-command/m-p/30561#M6201 dwaddle 2011-12-07T20:30:02Z https://community.splunk.com/t5/Splunk-Search/Is-the-duration-field-always-in-seconds-transaction-command/m-p/30562#M6202 <P>Thanks, that's exactly what I needed to know!</P> Wed, 07 Dec 2011 20:30:45 GMT https://community.splunk.com/t5/Splunk-Search/Is-the-duration-field-always-in-seconds-transaction-command/m-p/30562#M6202 msarro 2011-12-07T20:30:45Z https://community.splunk.com/t5/Splunk-Search/Is-the-duration-field-always-in-seconds-transaction-command/m-p/30563#M6203 <P>Would a condition of duration&gt;300,000,000 make sense, seeing as how that is 9.5 years? Splunk ships with certain pre-built queries for ES, and one of them had that condition. The query was titled 'Long Lived Connections' but that sort of seems ridiculous to me. I know this question is old but it seems the most relevant and I would hate to open a whole new question if I can get a quick answer here. </P> <P>Thank you!</P> Wed, 14 Dec 2016 20:59:45 GMT https://community.splunk.com/t5/Splunk-Search/Is-the-duration-field-always-in-seconds-transaction-command/m-p/30563#M6203 Justin1224 2016-12-14T20:59:45Z