I believe commands like "transaction" work on the _time metadata field that is hidden in each event. This is similar to timechart or bucket. The problem here is that the events I have get indexed all at once, and _time gets stamped to that one single timestamp.
However, we still have the correct timestamp when the log events were generated. Therefor I try resetting _time to that timestamp like so: