This is something we've built a search command to do in the Splunk App for Transaction Profiling. Look in the menu for Samples -> Steps. The current version on Splunkbase, Preview 2, still requires you to identify each segment; but we're looking at ways to more generally define when a new segment starts.
Esp, the product team would like to engage with you offline. Can you please email transactionprofiling@splunk.com?
Thanks!
... View more
This is a bug (SOLN-1639) and it has been fixed in release 1.0.1 of Splunk_CiscoFirewalls.spl. Please download a new version of this add-on from Splunkbase.
-Dmitrii
... View more