Sorting will put all of the events related to a single request adjacent to each other. It's not "one event" necessarily, but you'll see all the events in a similar way.
If that really bothers you for some reason, and you really want everything to appear as one "event", then one possible alternative to transaction is, if you have parsed the remainder of the line into its own field (call it event_text ), you can do something like ... | stats list(event_text) as all_event_texts by request_id . That will give you a table where one column is the request_id and the other is all of the event_text values, ordered by time.
If you don't want people to bother with the search language, then write the searches for them and save them as saved searches. Then they just have to call up that saved search, and not bother with the language at all. You can event create a dashboard that points to these saved searches and just give your staff access to that dashboard.
One thing you might also look into is restricting searches for your staff. Each "role" you create in Splunk can have its own "Restrict search terms" prefix, and every search from users with those roles will be prefixed by that search term. So that's one way of forcing those users into certain "default" search choices. Look under any role in Settings > Access controls > Roles and you can modify this string for that role.
... View more