My apologies is this has been asked and answered.
We have logs that record several error entries for a single transaction. We have mapped the transaction ID as a field and would like to group all of the log entries for a particular transaction together to be counted as a single event. Would this be best done as the logs are consumed by Splunk or when searching and how would I go about doing it?
Thanks
What do you mean by "counted as a single event"?
It is best definitely to do at Search Time ("while searching") and you can use the transaction
command but if the events are time-sequenced already, this will be MUCH more efficient:
... | stats list(_raw) AS events BY transactionID