How do I get my transaction search to use the first start event as the starting point?

[jaihind_nalla]

Hi,
i have log file
and i am using startswith Starting Dispatcher and endswith completed.
but some times in the log there are 2 Starting dispatcher, so i want the transaction to consider first start , so that i will get correct duration.

appreciate help.

Thanks,
Jai

[to4kawa]

index=your_index sourcetype=your_sourcetype  "Starting Dispatcher" OR "completed"
| streamstats count(eval("Starting Dispatcher")) as session by transaction_keyword
| stats earliest(_time) as start latest(_time) as end range(_time) as duration count as flag by transaction_keyword session
| where flag > 1

Hi, @jaihind_nalla
start , end , duration are UNIX epoch time.
you can use convert or strftime

[martynoconnor]

Can you give me an example of the search you're currently using and I'll see if I can rework it to use stats instead of transaction. Transaction is a very costly search command, and you will almost always get better performance using stats instead.