Is the duration field always in seconds? (transaction command)

[msarro]

Greetings everyone,
I just want to verify that the transaction generated duration field is always in seconds. it doesn't say definitively in the transaction guide. The examples below allude to it being in seconds, but I'm not entirely sure. Any advice would be helpful, thanks!

[dwaddle · Accepted solution]

Yes, it is always seconds. But, it could be a floating point value for partial seconds if you have subseconds in your timestamps.

[msarro]

Thanks, that's exactly what I needed to know!

[Justin1224]

Would a condition of duration>300,000,000 make sense, seeing as how that is 9.5 years? Splunk ships with certain pre-built queries for ES, and one of them had that condition. The query was titled 'Long Lived Connections' but that sort of seems ridiculous to me. I know this question is old but it seems the most relevant and I would hate to open a whole new question if I can get a quick answer here.

Thank you!