Why is Transaction command not working as expected?

[indeed_2000]

I encounter with strange issue when i use transaction and at the end sort by duration it show highest duration is 15000 but when i remove transaction it show 17000 as highest duration!!!

FYI1:correct value is 17000 and there is no special filter exist here!

FYI2:duration directly print in log i just use transaction to aggregate two lines.

Here is with transaction command:

| rex "actionName.*\.(?\w+\.\w+)\]" | rex "duration\[(?\d+)" | rex "transactionId\[(?\w+-\w+-\w+-\w+-\w+)" |transaction transactionId | sort - duration | table duration actionName username

Here is without transaction:

| rex "actionName.*\.(?\w+\.\w+)\]" | rex "duration\[(?\d+)" | rex "transactionId\[(?\w+-\w+-\w+-\w+-\w+)" | sort - duration | table duration actionName username

Here is the log:
2022-05-30 12:39:34,262 INFO  [APP] [Act] actionName[us.st.zxc.asda.app.session.protector.QueryOnData.Allow] parameters[] transactionId[8d135d45-c117-4781-a3ed-9a6a9db7ce4d] username[ABC] startTime[1653898174262]

2022-05-30 12:42:26,109 INFO  [APP] [Act] actionName[us.st.zxc.asda.app.session.protector.QueryOnData.Allow] transactionId[8d135d45-c117-4781-a3ed-9a6a9db7ce4d] duration[171847] status[done]

any idea?

Thanks

[ITWhisperer · Accepted solution]

duration is a field that is (also) generated by the transaction command so the value you are extracting from the event (with rex) is getting overridden by the transaction command - try a different field name - even capitalising might work

 |  rex "actionName\[(\w+\.)*\.(?<actionName>\w+\.\w+)\]" | rex "duration\[(?<Duration>\d+)"
 | rex "transactionId\[(?<transactionId>\w+-\w+-\w+-\w+-\w+)"
 | transaction transactionId | sort - Duration
 | table Duration actionName username