Hey folks, I have a web application that logs several log lines per request. Each line is tagged with the request id of that request, so lines that were logged during the same request are tagged with the same request id. Example: request_id=1 things are happening request_id=1 bla bla request_id=2 things are happening over here too request_id=1 request is done request_id=2 request is done Is it possible to "aggregate" those lines into two events (one for request_id=1 and one for request_id=2)? Please note that I want to do the aggregation before indexing, not at search time (I don't want my staff to use things like the "transaction" command for every single query they make, just to see all lines of a request). I basically want this "transaction" behaviour by default. In my example, the logs are interweaved. If it makes my Splunk problems simpler, I can work around that by buffering all lines before logging them, but I would still like to aggregate them based on request_id (not based on ugly regular expressions for splitting things - I would like to make things as context free as possible and not depend on knowledge about the actual content (like known keywords or other similar hacks)). Thanks in advance Flo ... View more