I'm not seeing any smoking guns--it looks like the only difference is the filter search going into the transaction. Here are the respective normalized searches:
litsearch index=report_public host=prod* source=*ngny* ( "oejs.Server:jetty" OR "Started SelectChannelConnector" ) | fields keepcolorder=t "*" "_bkt" "_cd" "_si" "host" "index" "linecount" "source" "sourcetype" "splunk_server" | eval _txn_starts_with=if(searchMatch("oejs.Server:jetty"), 1,0) | eval _txn_ends_with=if(searchMatch("Started SelectChannelConnector"), 1,0) | pretransaction host,source startswith="oejs.Server:jetty" endswith="Started SelectChannelConnector"
litsearch index=report_public host=prod* source=*ngny* | fields keepcolorder=t "*" "_bkt" "_cd" "_si" "host" "index" "linecount" "source" "sourcetype" "splunk_server" | eval _txn_starts_with=if(searchMatch("oejs.Server:jetty"), 1,0) | eval _txn_ends_with=if(searchMatch("Started SelectChannelConnector"), 1,0) | pretransaction host,source startswith="oejs.Server:jetty" endswith="Started SelectChannelConnector"
... View more