Transaction command not working

[shashank_24]

Hi, I am trying to use transaction command where I need to get the data from 2 specific events with different sourcetypes. These 2 events are 

2020-07-09 12:50:09,918 id="id:1234" event=test_attempt app= connid=myapp status=inprogress responsetime=7 inmessagetype="Request"

2020-07-09 12:50:09,105 id:1234 INFO  [org.test.validator.MediaValidator] in MediaValidator VERIFIED [email protected] found and match

The 1st event could occur multiple times in the same transaction and that's why sometimes my transaction command is just grouping those 2 events and that's it.
The common attribute in both of these events are id on which I am using transaction like below but it doesn't seem to be working.

Sometimes I am only getting single event and sometimes the 1st event is grouped together 

Can someone advice what could be done here to achieve this task. I can't use join because of the subsearch limitation and I have to use the transaction.

index=myindex (sourcetype="server_log" "[org.test.validator.MediaValidator] in MediaValidator) OR (source="/app/log/splunk-audit.log" event=test_attempt inmessagetype="Request" sourcetype=audit_log)
| rex field=_raw "id\=\"id\:(?<id>[^\"]+)"
| rex field=_raw "id\:(?<id>[^\s]+)"
| transaction id keepevicted=true

 @gcusello @to4kawa 

[richgalloway · Accepted solution]

Instead of transaction, try stats

| stats values(*) as * by id

.

[shashank_24]

@richgalloway Thanks for the response. I knew this solution with stats but I was trying to understand why transaction is not working. Anyways I was able to achieve with stats so i will accept the answer.