How is the duration calculated in the Transaction ... - Splunk Community

Splunk Search

Hello All,

I was wondering how is the duration field in the Transaction Command calculated? Is it based on each eventcount within that one transaction?

Thanks,
AntM

it's just the difference between the timestamps of the first event and the last event in the transaction.

Thanks! Appreciate the help!

in seconds.
and if your transaction is not finished duration=0...

Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...