Use transaction, use the duration field that it creates.
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Transaction
Use transaction, use the duration field that it creates.
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Transaction