I'm new to Splunk, so apologies if this is a silly question. I have a log file that reads:     2023-03-22 00:57:09,517 INFO TestScript - Generating reports with date of 20230321 and thread pool size of 5 ... ... 2023-03-22 00:59:23,681 INFO MultiTestScript - Multi Test report generation completed successfully!       and I am trying to extract the elapsed time between these two events. If I try this search     <search terms> | transaction startswith="Generating reports" endswith="report generation completed"       I get no results found.   If I search for the two halves of the transaction separately, i.e.     <search terms> | transaction startswith="Generating reports"     and     <search terms> | transaction endswith="report generation completed"     the search returns the appropriate part of the log file. As soon I combine the startswith= and endswith= fields in a single search, however, I get no results.   This query works properly with another log file. The only difference I can see between the files is that the file that works contains multiple transactions (i.e. "Generating report"/"report generation completed" pairs) while the files that won't work contain only one.   ... View more