You could use transaction
with a maxpause of 5 minutes. That way Splunk will create a new transaction when no additional events are found within 5 minutes after an event. Let's say the text you're matching on is available in the field "status_message".
... | transaction maxpause=5m status_message
Using this you'll get a bunch of transactions - in the cases where another event has occurred within 5 minutes after the a previous event, all these events will be put into the same transaction.