first: one minor change to the REGEX for the 404 status events:  if you use REGEX =  .*404.* it takes up events that have maybe a status 200 followed by 404 also. To prevent this you could use this REGEX instead:    "\s404\s    that way it only takes the first number after a quotation mark and a blank space also if you try to change the index AND the sourcetype for one input you might run into problems since splunk could potentially first address the new sourcetype and then try to send events into new indexes given the regex above. BUT when this happens they are already sourcetype=access_combined and not weblog anymore so it won't work or only one of those transforms.  the solution is as follows:  in props.conf your stanza shouldn't address the sourcetype "weblog" but rather the source from which your data originates.  [source::access_combined_no_breaks.log] this way it doesn't matter what happens first with your data cause the source will always stay the same.    hope this helps anyone who might run into the same problems. if so, pls consider thumbs up 🙂  ... View more

Transaction does not go outside the time range of the search since it is only grouping events after they have been returned and does not affect the results returned by previous pipes in the search. What you might want to do is expand the time range a little bit on either end to try to catch those starts and ends. For example you could include 11:55 PM to 12:05 AM, then filter further down in the search for transactions where adding the duration to _time doesn't put it on the current date to get rid of ones that started and finished before midnight. Filter again for transactions where _time gives the current date to rule out anything that started after midnight. To do that, you'd want to look at eval functions like strftime() , now() , relative_time() . ... View more