@isoutamo    The sample events look like these. 2020-11-04 20:50:42; SOURCE="source1"; sourcetype="abc"; PLATFORM="platform1"; SERVICE="xxxx"; EVENT_MESSAGE="Processing event  with correlationId: C001 at: 20:50:42.374 2020-11-04 20:50:43; SOURCE="source1"; sourcetype="abc"; PLATFORM="platform1"; SERVICE="xxxx"; EVENT_MESSAGE="Processing completed for event  with correlationId: C001, at: 20:50:43.382" And my original query is as below. index=xyz sourcetype=abc SERVICE="xxxx" "Processing event with correlationId: * at: *" OR "Processing completed for event  with correlationId: *, at: *" | table co_id, host, EVENT_MESSAGE, time1, time2 | sort co_id host | transaction co_id   Where co_id, time1, time2 are extracted fields. ... View more

@bowesmana  @isoutamo  Apologies, I have missed to mention that there is a correlation id that ties the events like you said. Events look something like this, event a -  Processing started at : <timestamp> for correlationid001 event b - Processing started at : <timestamp> for correlationid002 event c - Processing completed at: <timestamp> for correlationid001 event d - Processing completed at: <timestamp> for correlationid002 So, correlationid001 ties a -->c correlationid002 ties b-->d I have extracted the correlation id as a field. ... View more

@bowesmana  Thanks for the help. I will try the options you've provided. And answer to your question "how have you established the two events (A and B) as being the ones used to establish the duration?" It was provided to me by the developer of the service/component that these events should be the ones used to establish the duration. ... View more

Thanks for the reply @inventsekar. In my current search, the time stamp i.e,  _time is being captured only in sec. Suppose Event A is logged at 10:00:21.000 & Event B is logged at  10:00:21:450 in real time. The time stamps in splunk would still show it as  Event A @ 10:00:21.000 Event B @  10:00:21.000 So when i use transaction it would give me o as duration. This was the reason the developer has added timestamps in the events, which when logged in splunk would show the timestamps with ms info.  Is there any way I could use of the extracted fields of timestamps? ... View more