Yes the transaction comman with bounderies would be a good start, but also use event tags. Tag both events with something meaningfull. Event A has tag=Error1 Event_B has tag=Error2 index=someindex AND (tag=Error1 or tag=Error2) | Transaction host startswith="unable to" endswith="connection failed" maxspan=1m Additional Reading: UseSplunkForEventCorrelation splunk-book-excerpt-grouping-events event-correlation Tageventtypes Keep in mind that is only an example. Hope this helps or gets you started. Dont forget to vote up and accept answers that help. Cheers ... View more