https://community.splunk.com/t5/Splunk-Search/Error-in-transaction-command-Descending-time-ordered-events/m-p/301312#M90726 <P>Do this:</P> <PRE><CODE>| eval _time=strptime(timegenerated,"%Y-%m-%dT%H:%M:%SZ") | sort 0 - _time | transaction fields=hostname maxspan=60m </CODE></PRE> Tue, 04 Apr 2017 01:01:44 GMT woodcock 2017-04-04T01:01:44Z https://community.splunk.com/t5/Splunk-Search/Error-in-transaction-command-Descending-time-ordered-events/m-p/301311#M90725 <P>I believe commands like "transaction" work on the _time metadata field that is hidden in each event. This is similar to timechart or bucket. The problem here is that the events I have get indexed all at once, and _time gets stamped to that one single timestamp.</P> <P>However, we still have the correct timestamp when the log events were generated. Therefor I try resetting _time to that timestamp like so:</P> <PRE><CODE>| eval _time=strptime(timegenerated,"%Y-%m-%dT%H:%M:%SZ") | transaction fields=hostname maxspan=60m </CODE></PRE> <P>This works for bucket and timechart, however, it's not working for transaction:</P> <PRE><CODE>Error in 'transaction' command: Descending time ordered events required, but the preceding search does not guarantee time order </CODE></PRE> <P>Is there a way to overcome this and get transaction to work on the new _time field? Is there any other way to accomplish this?</P> Mon, 03 Apr 2017 23:59:21 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-transaction-command-Descending-time-ordered-events/m-p/301311#M90725 thisissplunk 2017-04-03T23:59:21Z https://community.splunk.com/t5/Splunk-Search/Error-in-transaction-command-Descending-time-ordered-events/m-p/301312#M90726 <P>Do this:</P> <PRE><CODE>| eval _time=strptime(timegenerated,"%Y-%m-%dT%H:%M:%SZ") | sort 0 - _time | transaction fields=hostname maxspan=60m </CODE></PRE> Tue, 04 Apr 2017 01:01:44 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-transaction-command-Descending-time-ordered-events/m-p/301312#M90726 woodcock 2017-04-04T01:01:44Z