How do I group events that are less than 15 seconds apart?

[brook8128]

| transaction uno, programId, devicetype maxpause=15s
| eval s_time=_time | eval e_time=_time+duration
| eval watch_sec = e_time - s_time
| eval _time=s_time
| eval s_time = strftime(s_time, "%Y-%m-%d %H:%M:%S")
| eval e_time = strftime(e_time, "%Y-%m-%d %H:%M:%S")

| transaction uno, programId, devicetype
| eval s_time=_time | eval e_time=_time+duration
| eval watch_sec = e_time - s_time
| eval _time=s_time
| eval s_time = strftime(s_time, "%Y-%m-%d %H:%M:%S")
| eval e_time = strftime(e_time, "%Y-%m-%d %H:%M:%S")

When I use maxpause, events(00:00:00~00:06:50) are dropped.
I've changed it for 20 seconds, and then events(00:00:00~00:09:00) are dropped.

If there's any other way not to drop events, I want you to let me know.
Thx.

edit) I want to find time to use the program by user. There are about 400 million events a day, so I'm working on reducing these to about a million. I edited spl. Thx.

edit) My goal is
before)
00:00:00 ~ 00:59:57
01:00:03 ~ 01:59:58
02:00:02 ~ 02:30:00
04:30:00 ~ 04:59:56
05:00:01 ~ 05:30:00
21:30:00 ~ 21:59:55
22:00:04 ~ 22:30:00

after)
00:00:00 ~ 02:30:00
04:30:00 ~ 05:30:00
21:30:00 ~ 22:30:00

[woodcock · Accepted solution]

DO NOT USE transaction! Try this:

index=<You should always specify an index> AND sourcetype=<And sourcetype too>
| streamstats current=f last(_time) AS next_time BY uno, programId, devicetype
| eval pause = next_time - _time
| streamstats count(eval(pause>15)) AS sessionID BY uno, programId, devicetype
| stats range(_time) AS duration list(_raw) AS _raw list(_time) AS time BY sessionID, uno, programId, devicetype

[brook8128]

It works!!!
Thank you for your answering!!!!

[niketn]

@brook8128 please add more details for the community to assist you better. What is the data you are trying to correlate? what does your current SPL look like?