Identifying a transaction from a real time event stream having latency. A method of the invention receives events from the real time event stream where events define a plurality of transactions to be identified. Each of the transactions includes a first event and a second event; the first event has a first latency relative to the real time event stream and the second event has a second latency relative to the real time event stream. The first event is identified from the received real time event stream, and a time is record when the first event is received. The method determines a time period during which the second event occurs as a function of the first latency, the recorded time of the first event, and the second latency. The transaction having the first and second events is identified based on the determined time period of the second event.