Latency between transactions

[josekuzh]

I have logs which show a transaction with clear startswith and endswith tabling the duration taken like so

source=*.csv | transaction E2ETxnSeq startswith="StartInbound" endswith="EndInbound" | table duration

I'm looking for finding the latency between transactions (or actually the idle time between traansactions) so how do I pipe the above output to calculate the delta ?

Thanks

[josekuzh]

actually they occasionally can but i can ignore those cases

[Ayn]

If transactions do not overlap, I imagine you could use delta for this.

source=*.csv | transaction E2ETxnSeq startswith="StartInbound" endswith="EndInbound" | delta _time AS transactionlatency | eval transactionlatency=-transactionlatency | table duration transactionlatency

[josekuzh]

I've tried this and transactionlatency is always 0 which doesnt match our data set. Still checking

[lguinn2]

Can transactions overlap?