index=ecomm_wire_remittance_transfer

"WirePaymentPolicyManagementV001.prepareTransactionAuthorization"

| rex "duration\s*=\s*(?<duration_time>\d+:\d+:\d+\.\d+)"

| eval duration_sec = tonumber(strptime(duration_time, "%H:%M:%S.%3N"))

| where duration_sec > 14

| table _time, duration_time, duration_sec, host, Calling_App, service_name, status

| sort -_time