In this particular example it is just determining the transaction duration, and even in martin_mueller's response to the following thread it still seems to create a new view of the data which I'd modify to my taste... http://answers.splunk.com/answers/133288/transactions-grouping-actions-and-matching-on-multiple-fields.html something like; | stats range(_time) as duration first(myfield) as myfield by transactionID But I don't see a way to then search that for the string "hello". You may have to use the transaction command if you want to do post-transaction searching. Hopefully someone can correct me on that and show us both how to use the stats command to do so. ... View more