We are pushing in [json] events with a timestamp field that contains time since epoch in milliseconds, eg:
{[-]
  name : "fetch.thing",
  correlationId: 'xyz', 
  timestamp : 1366040759635
}
when I try to do query :
 * | spath name | transaction correlationId | chart max(duration) by correlationId 
The durations are all 0 despite the timestamps not being the same. 
I suspect this is because the duration is in seconds.
Is this the case?
If so, is it possible to display duration in milliseconds?
Thanks, Tom
As far as I know you can only get durations in seconds from the transaction command. But, transaction is expensive and can often be replaced with stats like this in this case. And, you get the benefit of solving your problem while you're at it 🙂
This should do it (obviously untested though):
* | spath | stats range(timestamp) as durationms by correlationId | eval duration=durationms/1000
