Hi as other already said, 1st you must define what you want to be in your transaction? Usually it contains events mapped by client and JSESSIONID like index=web sourcetype=access_combined | transaction startswith=<any start action for transaction> endswith=<end action for transaction> clientip JSESSIONID | table _time JSESSIONID clientip action | sort 0 _time You could/should change those parameters for transaction command based on what you want to find. Also using stats like @gcusello shows is one option, but as said, 1st you need to know what is your transaction. r. Ismo  ... View more