topic Re: Why am I getting different results for the same search in Splunk Search

Why am I getting different results for the same search

eckdale — Mon, 15 Jul 2019 19:32:38 GMT

If I run the same search using two different time windows I consistently get different results.
I'm looking to count the number of email messages sent. The search query is simple:

index="linux" sourcetype="syslog" | transaction queue_id

When i search for a time range of 19:00:00 to 19:30:00 I get the following results (note from 19:21 on there are zero results):

If I then search for 19:21:00 to 19:22:00 I get the following results (note: now where are 245 events):

Re: Why am I getting different results for the same search

woodcock — Mon, 15 Jul 2019 20:06:54 GMT

Because transaction is a command that consumes a HUGE amount of RAM and when scaled to any practical time-window will exhaust all RAM available to you and your search and WILL SILENTLY ABORT yielding partial results and NO INDICATION THAT HAPPENED (unless you Inspect your job and check the search.log). This is the main reason that I am constantly harping: DO NOT USE transaction! So don't use it.

Re: Why am I getting different results for the same search

eckdale — Mon, 15 Jul 2019 20:27:24 GMT

So that's good to know. I'll inspect the job and look into search.log for more details.

Two questions then:
If I can't use transaction to group multiple events then what do I use?
My single-instance Splunk Enterprise server has 256GB of memory and appears to use very little of that memory. Am I really exhausting resources?

Re: Why am I getting different results for the same search

eckdale — Mon, 15 Jul 2019 20:33:52 GMT

Per your instruction I took a look at Inspector (should have done this originally) and it does indicate: "Some transactions have been discarded. To include them, add keepevicted=true.

Adding that to the query does in fact resolve the issue.

Re: Why am I getting different results for the same search

twinspop — Wed, 17 Jul 2019 13:47:18 GMT

Adding to what Woodcock said above, I've found transaction can be replaced by stats in most situations with a little extra effort. Obviously it depends on what you're trying to report on, but something like this:

index=linux sourcetype=syslog 
  | stats last(somefield) as last_something first(somefield) as first_something range(_time) as span by queue_id

Re: Why am I getting different results for the same search

woodcock — Wed, 17 Jul 2019 21:20:47 GMT

Even so, do not use transaction; take the time and effort to use *stats.