extended events rpc_completed duration does not matching with rpc_starting Does rpc_completed duration (micro_sec) = rpc_starting.timestamp - rpc_completed.timestamp?
In my case, I saw a big difference between them. Duration is only few millsec, where rpc_starting.timestamp - rpc_completed.timestamp is 6 - 10 sec.

I am on enterprise 2016 sp2-cu14, the duration field is in microsecond. I did similar thing for catching sp_statement_starting and sp_statement_completed, sp_batch_starting/sp_batch_completed inside rpc_starting and rpc_completed. it shows the same situation. My question is &quot;which one tell me how much time the query actually took? Is it Duration in sp_statement_completed or the difference between starting and completed?&quot;
My question is &quot;which one tell me how much time the query actually took? Is it Duration in sp_statement_completed or the difference between starting and completed?&quot;

&quot;Duration&quot; in the sp_statement_completed event is how long the query actually took at the server.  It doesn't include the time spent sending results to the client (usually, see here for details).
I'm not 100% sure why the Extended Events timestamp column shows such a large discrepancy between the &quot;starting&quot; and &quot;completed&quot; events, but that's not where you want to focus your attention.