https://community.splunk.com/t5/Splunk-Search/sequential-transactions/m-p/68863#M17284 <P>Any way to limit transactions to sequential records rather than by time? I have tens of thousands of IDs that can appear many times in a source. Each event of the source has the same _time (the index time of the source). </P> <P>I'd like to sort the IDs and then transact on ID sequentially so that if the next event matched the ID it would transact on that. However if it did not match the next ID that transaction would be closed. </P> <P>does this make sense? is this possible?</P> <P>thanks</P> Wed, 19 Jun 2013 19:21:29 GMT marquiselee 2013-06-19T19:21:29Z https://community.splunk.com/t5/Splunk-Search/sequential-transactions/m-p/68863#M17284 <P>Any way to limit transactions to sequential records rather than by time? I have tens of thousands of IDs that can appear many times in a source. Each event of the source has the same _time (the index time of the source). </P> <P>I'd like to sort the IDs and then transact on ID sequentially so that if the next event matched the ID it would transact on that. However if it did not match the next ID that transaction would be closed. </P> <P>does this make sense? is this possible?</P> <P>thanks</P> Wed, 19 Jun 2013 19:21:29 GMT https://community.splunk.com/t5/Splunk-Search/sequential-transactions/m-p/68863#M17284 marquiselee 2013-06-19T19:21:29Z https://community.splunk.com/t5/Splunk-Search/sequential-transactions/m-p/68864#M17285 <P>You could probably do something crazy like eval _time=ID. Since time is internally just an integer anyway, this probably will work. Of course after you do that the timestamps will be horribly off, but they should at least be ordered as the IDs were.</P> Wed, 19 Jun 2013 20:42:51 GMT https://community.splunk.com/t5/Splunk-Search/sequential-transactions/m-p/68864#M17285 cschmidt0121 2013-06-19T20:42:51Z