https://community.splunk.com/t5/Splunk-Search/Using-the-transaction-command-why-are-events-from-the-same/m-p/164935#M46836 <P>It looks like you have bad line-breaking.. If this is the case, then you should fix it at the index level compared to using a transaction command at the search level to maximize performance. Is the current line-breaking correct?</P> Mon, 10 Aug 2015 23:10:28 GMT skoelpin 2015-08-10T23:10:28Z https://community.splunk.com/t5/Splunk-Search/Using-the-transaction-command-why-are-events-from-the-same/m-p/164934#M46835 <P>I am using the transaction command, but the events are not collated when they took place at the same time and directory</P> <PRE><CODE>eventtype=ossec integrity HKEY NOT tag::eventtype=noise | transaction reporting_host,file_dirname </CODE></PRE> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/543iD3C5330F37A8A6A9/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Mon, 10 Aug 2015 07:12:55 GMT https://community.splunk.com/t5/Splunk-Search/Using-the-transaction-command-why-are-events-from-the-same/m-p/164934#M46835 sameeripro 2015-08-10T07:12:55Z https://community.splunk.com/t5/Splunk-Search/Using-the-transaction-command-why-are-events-from-the-same/m-p/164935#M46836 <P>It looks like you have bad line-breaking.. If this is the case, then you should fix it at the index level compared to using a transaction command at the search level to maximize performance. Is the current line-breaking correct?</P> Mon, 10 Aug 2015 23:10:28 GMT https://community.splunk.com/t5/Splunk-Search/Using-the-transaction-command-why-are-events-from-the-same/m-p/164935#M46836 skoelpin 2015-08-10T23:10:28Z