When the transaction is made |transaction ID MCN| or | transaction ID MCN startswith="begin.action" endswith="end...action" it grabs the events with the matching fields for ID and MCN
So in case 1 ID and MCN match on lines 1 + 4, and 2 + 3. The duration is calculated from the difference between the first event and last event in the transaction. e.g line 4 time - line 1 time = duration.
Case 2 should match lines 1+2 and 3+4.
You can read more here: http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/transaction
... View more