You should see the latest events at the top (splunk stores events in reverse time order, and transaction assumes this.) Therefore in the web view, you must see the LS-XUCF (end) events appearing above the LS-XUBF (start) events for your transaction to work. Here is what gets even more confusing (at least at first): When looking at the output of the transaction command, each individual transaction will show the individual events in normal time order, so you will see the first event first, and the later events at the end; but the transactions themselves are in reverse time order. ... View more

Using mvindex was the key - thank you so much! ... View more