It's been so long since I thought about this I can't recall how it came out. I think the issue I had with the loguid field is that I was seeing the same value from different hosts. I took a look at my dashboards and my transaction command has both the host and loguid fields.
But the answer for me is |transaction. Unfortunately, our firewall index is so large that the performance of these searches is really poor.
