I included this as an example in case you need it. The next line creates a single field to make the transaction from, building a single 'workerID' field that prepends '2a' or '2b' to the id_worker_sys field so that they're a) in a single field so you can build the transaction out of it but still maintain separateness so they won't overlap.You should be able to add in anything you want here, though keep in mind you'll have to squeeze it into the transaction somehow. Line three appends data, starting from a search that pulls in all events you want in the second transaction.The first line is our base search where we ONLY include the events we want in one of our transactions.| transaction workerID startswith='yourCriteria' maxspan=100s connected=t ] | eval workerID='2b'.id_worker_sys2b | eval workerID='2a'.id_worker_sys2a | append [search eventtype=UpdateWorkerSystem2 OR (eventtype=UpdateWorkerSystem1. | transaction id_worker_sys1 startswith='PATCH /api/workers/' maxspan=100s connected=t So, in your case, something like the below (which is not exactly complete or full, but more of a general idea - give the techniques a try and see how far you get, ask for more help if you hit a specific stumbling block). Those two searches are completely independent from one another and can have the same or different contents. The idea will be to create a search that pulls out all the items you want in one transaction and build the transaction out of them, then create a second search and run it with append that pulls out all the items you want in the second transaction and build the transaction you want out of them. Where fieldnames overlap it 'reuses' the field names, otherwise it just sticks the appended stuff in new fields with new names (you can see that in the first example given, where 'count' matches so it goes in the same column). Append takes the pile of events from one search and tacks onto the end another pile of events from a second search. Transaction alone can't do that, but used with append can. Does the transaction syntax even support brackets and/or the 'exclusive or' (XOR)? If my question made sense, is there another way to achieve what I want to do? It seems to me that when I create a transaction like this, the transaction command only 'sees' the id_worker_sys1 field. system 2, then all events in that transaction has to have a worker id from system 2 ( id_worker_sys2a or id_worker_sys2b). The grouped events could contain the id of both a worker in system 1 and one of the id's of a worker in system 2, but if the first event in that transaction has a worker id from e.g. What I'm trying to do in this example is to create transactions where the grouped events is grouped based on either the id of a worker in system 1 or one of the two id's of a worker in system 2. | transaction id_worker_sys1 XOR (id_worker_sys2a id_worker_sys2b) startswith='PATCH /api/workers/' maxspan=100s connected=t eventtype=UpdateWorkerSystem1 OR eventtype=UpdateWorkerSystem2 What I'm wondering is if it's possible to use the transaction command to create transactions in parallel based on distinct fields, where the starting event defines what fields are used to group events for this transaction? That probably made no sense, I'll give an example. Each of the alerts is running a search and creates transactions. To save resources, I want to combine several scheduled alerts into one.

Splunk transaction command examples