There are several ways to group events. The most common approach uses either the transaction or stats command. But when should you use transaction and when should you use stats ? The rule of thumb: If you can use stats , use stats . It’s faster than trans- action , especially in a distributed environment. With that speed, how- ever, comes some limitations. You can only group events with stats if they have at least one common field value and if you require no other constraints. Typically, the raw event text is discarded. Like stats , the transaction command can group events based on com- mon field values, but it can also use more complex constraints such as total time span of the transaction, delays between events within the trans- action, and required beginning and ending events. Unlike stats , trans- action retains the raw event text and field values from the original events, but it does not compute any statistics over the grouped events,