The portions are just underscores. The search would be as follows with the replaced and fixing the counter field missing:
id | eval mytime=time
| transaction id startswith="start" endswith="stop"
| eval transactionid=id._time
| stats min(mytime) AS start max(mytime) AS stop values(id) AS id values(duration) AS duration by transactionid
| eval mytimeconcat="1".start." -1_".stop
| eval mytimemv=split(mytimeconcat," ")
| mvexpand mytimemv
| rex field=mytimemv "(?(1|-1))_(?<_time>\d+)"
| table _time id counter
| sort _time
| bucket _time span=5m
| makecontinuous _time span=5m
| streamstats sum(counter) AS concurrent_counter
| table _time concurrent_counter
Cheers!!!
... View more