I could retrieve the list of the transactions as a single event below. Transactions start with "Dashboard Load:" and end with "Total Dashboard Load Time" | rex "Account: (?<account>[^\,]*), SiteID: (?<siteID>[^\s]*) - (?<duration_in_ms>[^\s]*) milliseconds on Requestor: (?<requestor>[^\,]*)"
| transaction agent endswith="Total Dashboard Load Time"
| eval duration_in_sec=round(avg(duration_in_ms)/1000,2)
| table agent account siteID flow duration_in_sec I could find the delta between each event as multiple events with below | rex "Account: (?<account>[^\,]*), SiteID: (?<siteID>[^\s]*) - (?<duration_in_ms>[^\s]*) milliseconds on Requestor: (?<requestor>[^\,]*)"
| streamstats current=f last(_time) as last_time2 by agent
| rename _time as current_time2
| eval delta= last_time2 - current_time2
| eval last_time =strftime(last_time2, "%m/%d, %H:%M:%S.%6N")
| eval current_time =strftime(current_time2, "%m/%d, %H:%M:%S.%6N")
| table agent account siteID flow duration_in_sec last_time current_time delta I'm looking to see if I can find a delta between events in a single transaction. The transaction starts with "Dashboard Load" and ends with "Total Dashboard Load Time" Expected Result Format: agent, account, siteID, list of flow (all 5 Dashboard Load actions), duration_in_sec, list of event times, list of delta between event time agent - the name of the agent account - account # siteID - site# list of flow - all action flows durations_in_sec - Total Dashboard Load Time list of event times - List showing all event time list of the delta between event time - List showing 4 delta times between each flow Below are a sample of 2 data of 5 events 2021-12-16 05:30:43,834 alpha - Dashboard Load: User Clicked on New
2021-12-16 05:30:46,498 alpha - Dashboard Load: User Clicked on AccountSearch
2021-12-16 05:31:05,420 alpha - Dashboard Load: User Clicked on Search with String abcdef
2021-12-16 05:31:08,557 alpha - Dashboard Load: User clicked on Searched Result 123456
2021-12-16 05:31:12,234 alpha - Total Dashboard Load Time for Account: 000111222, SiteID: 123- 3438.0 milliseconds on Requestor: xoxoxo
... View more