How do you merge multi-threaded (non-consecutive) log entries into events?

[kpattison]

I have a multi-threaded application in Glassfish. A single event generates multiple lines of logging but multiple events can happen simultaneously causing logging to alternate between one event and another. Each event though will be on a distinct thread ID in the logs.

Is it possible to search for a string and have all the lines withing the min before and after that are on the same thread ID merged to be the one event?

[bgaignon]

Not sure to understand but maybe transaction can help.

index=glassfish | transaction id_thread keepevicted=true

Transaction consume a lot of resources so reduce the time range.
Every events with the same id_thread will be concat to one.

[kpattison]

Can I assume that this is not possible in Splunk?