I am trying to find the duration of a beginning and ending event using the transaction command. The search I am using is:
"WebService Method Call Received for Level 2 Appeal Number" OR "Succesfully promoted appeal" | transaction MAS_L3SVC_UID | table MAS_L3SVC_UID, duration, _raw
The correct events are being paired based on my extracted field, but the duration does not seem to be calculated correctly for the 2 time stamps in the transaction. An example of the result is:
05/27/2016-12:58:17.028 - WebContainer : 0 - DEBUG [Provider : Line 171]: UID: XXXXXXXXX10009 - promoteAppeal - WebService Method Call Received for Level 2 Appeal Number: 1-1111111 and External Level 3 Appeal Number: ABC-DEFGHIJK
05/27/2016-12:59:05.231 - taskPool-2 - DEBUG [AppealPromoter : Line 171]: UID: XXXXXXXXX10009 - Succesfully promoted appeal 1-1111111
duration = 48.203
I've tried using different variations based on what I have seen in Answers and have also tried using stats. Nothing I've tried so far is giving the correct duration. Should I use a method other than transaction?
↧