topic Functionality of keepevicted not clear in Splunk Search

Functionality of keepevicted not clear

rrovers — Tue, 12 Jan 2021 10:19:10 GMT

I'm trying to understand the functionality of keepevicted. I've read several documentation about it but it's still not clear.

I've made a search with transaction. Without keepevicted I get 54 events, with keepevicted 62. I've searched the difference and found 1 with let's say the text "abc". When I add "abc" to the search (in the first line with index=....) without keepevicted the event is returned. I don't understand why that is.

Can someone explain?

The search is something like this:

index=main sourcetype="src_type1" *abc* earliest=1610441880 latest=1610445533.859
| eval tmpId=if(len(bi_Id)>0,bi_Id,if(len(bo_id)>0,bo_id,be_Id))
| transaction maxspan=5s tmpId
| rex field=que1 "\{(?<cliber>.*)\}"
| rex field=que2 "\{(?<serber>.*)\}"
| stats count as Aantal by cliber

Re: Functionality of keepevicted not clear

richgalloway — Tue, 12 Jan 2021 15:35:23 GMT

An "evicted" transaction is one which was not completed within the specified criteria. In the example, if another event with the tmpId field was not found within 5 seconds of the previous such event then the current transaction is evicted.

Re: Functionality of keepevicted not clear

rrovers — Wed, 13 Jan 2021 14:13:42 GMT

hi @richgalloway ,

Thanks for your answer but it's still not clear to me. I don't understand why the events with *abc* are not returned when I don't have *abc* in the first line. When *abc* is in the first line and the rest of the search is the same as the first search the events are returned.

Re: Functionality of keepevicted not clear

sheamus69 — Wed, 13 Jan 2021 14:38:39 GMT

Hi,

If my memory serves me correctly, transactions can only look at a finite number of events - if that number is breached then the transaction is cancelled.

Splunk docs for transactions show:

maxevents Syntax: maxevents=<int> Description: The maximum number of events in a transaction. If the value is negative this constraint is disabled. Default: 1000

Thus, when you add *ABC* to the start of the search, you are reducing the number of events that the transaction is searching through, compared to when you do not include *ABC*?

Re: Functionality of keepevicted not clear

rrovers — Thu, 14 Jan 2021 07:15:55 GMT

@sheamus69, thanks. I think you're right that this has to do with a limit. When I don't use keepevicted there is a limit of 4999 events. See also https://community.splunk.com/t5/Splunk-Search/Is-there-a-limit-on-the-number-of-events-returned-from-the/m-p/110802 . With keepevicted there is no limit or it is much higher.
The solution that works for me is to use keepevicted