With the transaction command, how do I get the duration between the first startswith to the last endswith?

[xindeNokia]

query like below:

| transaction startswith="Init" endswith="FINISHED" by ip
| table duration ip

Each IP has multiple "init" and "finish". Is there a way to group the first "init" to the last "Finished" instead of grouping the closest two?

Thanks in advance!

[renjith_nair · Accepted solution]

@xindeNokia,

Try stats

"your search"  "init" OR "finished" |stats earliest(_time) as first,latest(_time) as last by ip|eval duration=last-first

[xindeNokia]

it works, thank you very much! much appreciated!