I'm not sure I understand the reporting you're looking to present. Your search is just looking for data over the past 15 minutes, yet you're presenting a table that shows concurrent sessions by minute over the previous hour. I would think you'd want the reporting period in the table to match the time period for the search.
Using a transaction may be unnecessary since the STOP record has the fields you need to determine duration. Here's a search you can use with an explanation on search variables and functions:
sourcetype=Sonus Site=oma10 Ingress_TG_Name=ATT_0007* STOP earliest=-15m | strcat Start_Date " " Start_Time start | strcat Disconnect_Date " " Disconnect_Time end | convert auto(start) as start_time_secs | convert auto(end) as end_time_secs | eval start_time_secs=round(start_time_secs,0) | eval end_time_secs=round(end_time_secs,0) | eval dur=end_time_secs-start_time_secs | concurrency duration=dur start=start_time_secs | timechart span=1m max(concurrency) as "Concurrent Sessions"
1.) Base search:
sourcetype=Sonus Site=oma10 Ingress_TG_Name=ATT_0007* CDR_Type=STOP earliest=-15m
2a.) Concatenate values in "Start_Date" and "Start_Time" fields and call the new field "start"
| strcat Start_Date " " Start_Time start
2b.) Concatenate the "Disconnect_Date" and "Disconnect_Time" fields and call the new field "end"
| strcat Disconnect_Date " " Disconnect_Time end
3a.) Convert the "start" field to epoch seconds and call the resulting field "start_time_secs"
| convert auto(start) as start_time_secs
3b.) Convert the same with the "end" field and call the resulting field "end_time_secs":
| convert auto(end) as end_time_secs
4a.) Since the values in the "start_time_secs" field are in deciseconds, round to the nearest second:
| eval start_time_secs=round(start_time_secs,0)
4b.) Since the values in the "end_time_secs" field are in deciseconds, round to the nearest second:
| eval end_time_secs=round(end_time_secs,0)
5.) Subtract the "start_time_secs" from the "end_time_secs" and call the resulting field "dur":
| eval dur=end_time_secs-start_time_secs
6.) Use the concurrency command to calculate concurrency per second based on "dur":
| concurrency duration=dur start=start_time_secs
7.) Chart it to present peak concurrent sessions per minute, with 1-second granularity, over the past 15 minutes:
| timechart span=1m max(concurrency) as "Concurrent Sessions"
*** NOTE: You can simplify this a bit by using just the "Start_Date" + "Start_Time" + "Call_Duration" fields to determine duration if you do not want to include set-up and tear down of the sessions.
... View more