You do not normally need to extract anything at index-time. You can make your comparisons with search-time extracted data.
Don't know what you really want to do, and what the transaction is used for, but if max-execution-time is in seconds, the logic/math will be rather simple. Current time (when the search starts) can be found via now() .
...| eval XXX = _time + max-execution-time
| eval YYY = if(XXX > now() AND next-timestamp < now(),"apple", "orange")
Perhaps you want to also look at the dedup command to let you only get the most recent event for some field.
See;
http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/CommonEvalFunctions
Some more explanation and a few sample events would let people here understand your problem better and be able to help you more.
/K
... View more
