How do I reconstruct the path of a message across multiple events?

[asturt]

I have a log file from our ESB that has multiple events for each message. I want to join those back together so I can see how long the whole journey is taking, how many are not making it all the way, and so on.

I'm very new to Splunk, so I'm not at all sure how to chain those events together. Is having multiple queries of the same log chained together with the appendcols command a good approach? And, actually, even if I do that, how do I join an event from one query's result set to the matching event in the next query's result set?

[whrg]

Do events, which belong together, have a field in common?

If so, you could use the transaction command. This will add fields together based on one or more fields.

[asturt]

I found some documentation on selfjoin, but it's going to take me a while to figure out how to use it, and I don't know if it will do what I need.