how to calculate endtransactiontime - starttransactiontime when starttransactiontime is in one event and endtransactiontime is in another event

[smilingajay]

Hi !!
I want to calculate TransactionEndTime-TransactionStartTime, where TransactionStartTime is in CaptureLocation=Request and TransactionEndTime is in CaptureLocation=Response.

I tried using transaction but duration is showing 0.

Thanks in advance

My sample events:
Event1
10/17/2017 17:28:50.151 SPLUNK-TRACE - DateandTime=10/17/2017 17:28:50.151;ThreadID=767;ThreadName=WebContainer : 7;meta-transid=12345;TransactionEndTime=10/17/2017 17:28:50.151; Method=GET;URI=/abc/v1/xyz/;Node=Node1;TransactionStatus=SUCCESS;StatusCode=200;CaptureLocation=MicroserviceResponse;
Event2
10/17/2017 17:28:50.136 SPLUNK-TRACE - DateandTime=10/17/2017 17:28:50.136;ThreadID=767;ThreadName=WebContainer : 7;meta-transid=12345;TransactionStartTime=10/17/2017 17:28:50.136; Method=GET;URI=/misc/fep/procdiagcodesms;Node=Node1;CacheContentFlag=UNKNOWN;CaptureLocation=MicroserviceRequest;

[gcusello]

Hi smilingajay,
you have to identify fields for transaction (e.g. ThreadID) and then use transaction command or stats command.
With transaction command:

index=your_index
| transaction ThreadID
| table ThreadID TransactionStartTime TransactionEndTime

With stats command:

index=your_index
| stats values(TransactionStartTime) AS TransactionStartTime values(TransactionEndTime) AS TransactionEndTime BY ThreadID

The second one is quicker.

Bye.
Giuseppe