The transaction command in Splunk groups events based on common fields and creates a single transaction event. The timestamp assigned to the transaction is the timestamp of the earliest event in the transaction. This ensures that the transaction reflects the actual start time of the related events rather than the time the transaction is created or ended.
Reference:
Splunk Power User Study Guide, Chapter on Transaction Command
Splunk Documentation: transaction Command
"The timestamp of the resulting transaction is the timestamp of the earliest event in the transaction."