Hi ,
Thanks for the feedback. I have used
| transaction TxID mvlist=t | eval received_time= mvindex(Received, 0) | eval replying_time=mvindex(Replying,-1) | eval total_response_time = replying_time - received_time| timechart avg(duration)
and
transaction host startswith="Received" endswith="Replying"| timechart avg(duration)
and they both worked. However, I read that using "transaction" is quite expensive from a performance perspective. Is this correct? If so do we have any other way to do this?
... View more