i have log file
and i am using startswith Starting Dispatcher and endswith completed.
but some times in the log there are 2 Starting dispatcher, so i want the transaction to consider first start , so that i will get correct duration.
Can you give me an example of the search you're currently using and I'll see if I can rework it to use stats instead of transaction. Transaction is a very costly search command, and you will almost always get better performance using stats instead.
index=your_index sourcetype=your_sourcetype "Starting Dispatcher" OR "completed"
| streamstats count(eval("Starting Dispatcher")) as session by transaction_keyword
| stats earliest(_time) as start latest(_time) as end range(_time) as duration count as flag by transaction_keyword session
| where flag > 1
_start , end , duration are UNIX epoch time.
you can use convert or strftime