topic Re: Strange search behavior with "transaction" in Splunk Search

Strange search behavior with "transaction"

cnoulin — Tue, 29 Sep 2020 20:55:46 GMT

Hello,
Could someone explain me the following strange behavior with search

With this type of search :

sourcetype="cisco:esa:textmail" | transaction internal_message_id | search "My_email_address@address.com"

When i make a search on last 15 minutes, last hour or last 4 hours, my search work and return me answers .

If i use a specified period time it work too.

As soon as i use 24hours or more, the search give me no answer.

How to explain this ?

Sorry for my english and thanks in advance

Re: Strange search behavior with "transaction"

somesoni2 — Thu, 16 Aug 2018 17:13:59 GMT

The transaction command is very resource expensive command. You're using very basic transaction command (not additional transaction limiting options being used) and based on your data, the virtual memory usage could be very high and due to search being finalized, it may not be returning any data. I would say, try using stats instead of transaction for your search.

http://docs.splunk.com/Documentation/Splunk/7.1.2/Search/Abouttransactions#Using_stats_instead_of_transaction

Re: Strange search behavior with "transaction"

cnoulin — Fri, 17 Aug 2018 07:02:20 GMT

thank you for your answer.
I'm a splunk noob and try some differents syntax with the stat command but no one work...
Coulmd you help me and give me the syntax ?
I try different functions but no one work.

Re: Strange search behavior with "transaction"

cnoulin — Fri, 17 Aug 2018 07:06:45 GMT

another thing.
The goal is to have a "unique" log entry when i visualize in splunk.
Actually ESA send me one line by log and the complete mail transaction is very difficult to analyse.
Mayube there is another solution to aggregate during indexing instead of during visualization ?

Re: Strange search behavior with "transaction"

aakwah — Fri, 17 Aug 2018 09:08:26 GMT

Add keepevicted=true to your query:

sourcetype="cisco:esa:textmail" | transaction internal_message_id keepevicted=true | search "My_email_address@address.com"

If you run a query that will generates a lot of events without it you will find a green exclamation mark beside "job" with this message:

Some transactions have been discarded. To include them, add keepevicted=true to your transaction command.

Re: Strange search behavior with "transaction"

cnoulin — Fri, 17 Aug 2018 09:17:07 GMT

it work, perfect !
Thanks

Re: Strange search behavior with "transaction"

aakwah — Fri, 17 Aug 2018 14:34:23 GMT

Welcome !

Re: Strange search behavior with "transaction"

niketn — Fri, 17 Aug 2018 14:46:13 GMT

@cnoulin as @somesoni2 mentioned, stats is a better option for your use case. However, for us to assist you better you would need to provide more details on what fields and values you want to show after correlating them. If you lookup Splunk Answers you will find several examples.

sourcetype="cisco:esa:textmail" 
| stats count as eventCount min(_time) as _time max(_time) as LatestTime internal_message_id 
| eval duration=LatestTime-_time
| fields - LatestTime