Splunk – Transaction to calculate start and end time of component

host=cmhlpecomecm* EOMReservationService AND (started OR ended) 
  | eval tmp=split(_raw," ") 
  | eval thread=mvindex(tmp,5) 
  | transaction thread startswith="started" endswith="ended"
  | timechart span=1h avg(duration) median(duration)

The query above results in the following output on the Events tab of the UI…

…and the following graph on the Visualization tab of the UI…