I have a query that I'm trying to get the amount of time a transaction takes to execute. I was selecting only a piece of the transaction but it does have a transaction id in the data. This query returns results, "process start" OR "process end". Then i use Rex to grab the transaction id which also returns results, | rex field=_raw "Correlation Id: \[(?<correlation_id>.*)\] " Next step add transaction to this so it correlates the whole transaction ... this is where it fails the transaction addition doesn't return any results. I'm sure something is wrong with my query.  | transaction correlation_id _raw startswith="process start" endswith="process end" Can you use transaction on a generated Rex result? Thanks in advance. ... View more