I just want to verify that the transaction generated duration field is always in seconds. it doesn't say definitively in the transaction guide. The examples below allude to it being in seconds, but I'm not entirely sure. Any advice would be helpful, thanks!
Yes, it is always seconds. But, it could be a floating point value for partial seconds if you have subseconds in your timestamps.
Would a condition of duration>300,000,000 make sense, seeing as how that is 9.5 years? Splunk ships with certain pre-built queries for ES, and one of them had that condition. The query was titled 'Long Lived Connections' but that sort of seems ridiculous to me. I know this question is old but it seems the most relevant and I would hate to open a whole new question if I can get a quick answer here.