Extract the 2nd event time in a transaction

[ICAP_RND]

When using transaction, SPLUNK always use _time of the 1st event
I need to extract the time of the second event in a transaction
I tried to use Time=_time+duration, however the result sometimes is not accurate
I have used the following transaction command:
index=clientlogs FailedApp=* OR "WorkflowServer.CloseApplication * pid:" 4104 | rex field=Message.Text "pid: (?\d+)"| transaction AppPID host startswith="WorkflowServer.CloseApplication * pid:" endswith="Application * failed" maxspan=60s mvlist=t| eval Time=_time+duration | eval date = strftime(Time, "%Y-%m-%d %H:%M:%S.%2N")
1st event time: 2017-01-07 11:01:13.10
2nd event time: 2017-01-07 11:01:16.39
duration: 2.39 sec
The sum result is: 2017-01-07 11:01:16.40

1. Is there a better way to extract the second event timestamp?
2. If not, is there a way to fix this issue?

see results in the attached file

[martin_mueller · Accepted solution]

You can always run strptime() on the nth multivalue-member of the Message.Date field to parse its timestamp after the transaction.

[ICAP_RND]

The best workaround is as follows:
index=clientlogs FailedApp=* OR "WorkflowServer.CloseApplication * pid:" | rex field=Message.Text "pid: (?\d+)"| transaction AppPID host startswith="WorkflowServer.CloseApplication * pid:" endswith="Application * failed" maxspan=60s mvlist=t | convert timeformat="%Y-%m-%d %H:%M:%S.%2N" mktime(Message.Date) as Date | eval DD=strftime(mvindex(Date,1), "%Y-%m-%d %H:%M:%S.%2N")

but if someone has an answer to my questions above, I'll be glad to know

[somesoni2]

I've see the _time value being rounded up some times and that's what is showing it there (milliseconds being rounded off). See if this helps in the query that you've in your question

... | eval Time=_time+duration*1.00000 |...

Also, for your current working solution can be simplified as this (as the format of date is same in convert and strftime)

index=clientlogs FailedApp= OR "WorkflowServer.CloseApplication pid:" | rex field=Message.Text "pid: (?<AppPID>\d+)"| transaction AppPID host startswith="WorkflowServer.CloseApplication pid:" endswith="Application failed" maxspan=60s mvlist=t | eval DD=mvindex('Message.Date',1)

[ICAP_RND]

Thanks Martin
This workaround works
However, I want to know if I can use a direct method to extract the second event timestamp, and if not why duration is not working all the time