@niketnilay, Thank you for the input. Sorry for the delayed response. I tried your solution and it seems like it's calculating all the request and response as one event. I have tons of this kinds of request and response. and I need to calculate the duration for each one. So I used part of yours. Thank you very much!
| transaction msgId startswith="ABCRequest" endswith="ABCResponse" keepevicted=true | search closed_txn=1
| eval SLA = case(duration<=0.15,"ok",duration>0.15 AND duration<=0.25,"warning",duration>0.25 AND duration<0.30,"critical",true(),"breached")
| chart count by SLA
... View more