How do I group events by field (trans ID) and count as a single event?

[sglazier]

My apologies is this has been asked and answered.

We have logs that record several error entries for a single transaction. We have mapped the transaction ID as a field and would like to group all of the log entries for a particular transaction together to be counted as a single event. Would this be best done as the logs are consumed by Splunk or when searching and how would I go about doing it?

Thanks

[martin_mueller]

What do you mean by "counted as a single event"?

[woodcock]

It is best definitely to do at Search Time ("while searching") and you can use the transaction command but if the events are time-sequenced already, this will be MUCH more efficient:

... | stats list(_raw) AS events BY transactionID