I have a collection of individual log lines where each event contains a start time and a duration for an individual request. I would like to setup a dashboard that includes the count of concurrent (overlapping) events over time. I don't believe transaction will help (individual lines, so can't use duration there). Also, concurrency as I see it referenced elsewhere tracks the number of events that "start" within a particular period, not the events that overlap based start_time + duration as defined in the log line itself.
Sorry if this is an obvious question for the pros (very new to splunk), but any ideas or starting points would be appreciated! Thank you!