Calculating the time between events

[gsmi]

I am trying to pull some stats from splunk around how long a user session was active for.

in the logs i have a logon message, and either a corresponding log off message or a session timeout message and i can correlate the messages by a session token present in each message.

I have the following query which uses transaction to tie everything together

index=diagnostic (host="*ABC*" OR host="*DEF*" OR host="*XYZ*") (mod="Authenticator" AND opn="Logout Service" AND msgId="AUDIT_MSG_005" AND ssoTicket=* ) OR (mod="Authenticator" AND opn="Validate Service" AND msgId="AUDIT_MSG_005" AND ssoTicket=* ) OR (mod="SESSIONTIMEOUT" AND opn="SESSION_TIMEOUT" AND msgId="Working On Key:*")
| rex field=msgId "(?<ssoTicket><TOKEN REX>)" 
| fields ssoTicket,msgId 
| transaction ssoTicket startswith="Validate Service" endswith=("Logout Service" OR "SESSIONTIMEOUT")
| stats avg(duration) as "Avg Sess. Dur(sec)",perc25(duration) as "25th percentile",perc75(duration) as "75th Percentile",perc95(duration) as "95th percentile", max(duration) as "Max Sess. Dur(sec)", dc(ssoTicket) as "Unique Sess.", count(eval(duration>36000)) as "sess. > 10hrs"

However it does not appear to be returning all the results I expect, for instance If i run it for a 24 hour period I don't see any sessions that went over 10 hours. and the overall session count is a lot lower then i would expect for a 24 hour period.

I know there are sessions that hit the time out window as I can see the tiimeout message, and If i search for that session token along with the token of a session that was logged out, the stats look ok.

so how do I get transaction to return all the results i need, or produce the same stats without using transaction?

Thanks

[to4kawa]

see my previous answer:
https://answers.splunk.com/answers/815281/spl-query-to-check-event-start-and-end-if-there-is.html