Since that's a WebSphere plugin log file, and the WebSphere plugin can handle many simultaneous requests, those lines would not have to come in "chunks". You'll see those events interleaved more often in a WebSphere environment that has a higher number of simultaneous users.
As a result, the transaction command is likely the most reliable way to process this data.
You can use search macros and/or saves searches to help make it easier for end users to deal with those WAS plugin events. A nice example is in the [Splunk docs].
... View more