I ran in to the same issue, and after unsuccessfully trying to wrap my head around why Splunk sometimes "forgets" some of its field extractions when transaction is used I reverted to just rex extracting them from _raw after transaction and joined them. Not the prettiest of solutions, but it was the only way I was getting it to work.
... View more