Try modifying your transaction command to include the keepevicted flag, and then searching on the closed_txn field that transaction creates. You should take a look at the results of a transaction search to make sure that events where closed_txn=0 are those that you want to count as unfinished transactions. Also, I'm not sure that streamstats is needed. The Transaction command automatically creates a field called "duration" that contains the duration of the transaction. Examine it a and see if it fits your needs. So perhaps a search like this? charon | transaction startswith="established between" endswith="deleting IKE_SA" keepevicted=t | convert ctime(_time) as Date | eval Transaction_Status=if(closed_txn=1,"Finished","Unfinished") | table Transaction_Status duration ... View more

Got it and now have a better understanding of rex&regex. Thank you for all of your help and prompt responses! ... View more