Splunk transaction duration between events