An analyst must reconstruct a clerk session: civic VPN logon, then file-share access, then rare egress. The events share user and occur within a bounded pause. Which command should glue them into one session?

In Splunk Enterprise Security for a municipal SOC, transaction groups related events that share a field and fall within maxpause and maxspan so an analyst can reconstruct a multi-sourcetype session. Gluing a clerk’s civic VPN logon, then file-share access, then rare egress—events that share user and occur within a bounded pause—is a classic security use of transaction for the session story Incident Review needs. Using tstats summariesonly=true on Authentication only fails by concept because that stays inside one accelerated model and cannot span VPN, file-share, and egress sourcetypes as one timed session. Using eval alone to concatenate the three raw _raw strings into one field fails by concept because string concatenation is not session grouping with time bounds and shared keys. Using makeresults to invent a session row without reading the clerk’s events fails by concept because synthetic rows are not evidence of the clerk’s activity. Exam caveat: SPLK-5001 expects transaction with grouping and time bounds when the investigation needs a glued civic session across related events. Operational check: build transaction by user with explicit maxpause and maxspan covering the VPN-to-share-to-egress path, verify the session contains the expected event types in order, tighten bounds if unrelated civic noise joins the session, and export the session timeline into the case notes.