https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-limit-the-transaction/m-p/556288#M157965 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/234296">@moinyuso96</a>,</P><P>as you can see in the documentation (<A href="https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchReference/Transaction" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchReference/Transaction</A>), it's possible to define the maximum number of events to correlate using "<SPAN>maxevents" option.</SPAN></P><P><SPAN>Ciao.</SPAN></P><P><SPAN>Giuseppe</SPAN></P> Fri, 18 Jun 2021 06:51:18 GMT gcusello 2021-06-18T06:51:18Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-limit-the-transaction/m-p/556287#M157964 <P>After using transactions my "raw" field looks something like this. I want to limit the amount of rows captured&nbsp; by transaction to be not more than 2?&nbsp;</P><P>Is there anyway I can add to my query now&nbsp;</P><P>| transaction startswith=TestResult="Start"</P><TABLE border="1" width="43.8016530879737%"><TBODY><TR><TD width="100%">raw</TD></TR><TR><TD width="100%"><P><SPAN>4015_ABCD, Start, 8/11/2020 5:37:10 PM, 12345</SPAN></P><P><SPAN>4015_ABCD, Complete, 8/11/2020 5:37:30 PM, 12345</SPAN></P></TD></TR><TR><TD width="100%"><SPAN>4015_ABCD, Start, 8/12/2020 10:23:34 AM, 12345</SPAN></TD></TR><TR><TD width="100%"><P>1113_EFGH, Start, 8/12/2020 12:00:00 PM, 67890</P><P>1113_EFGH, Complete, 8/12/2020 1:00:00 PM, 67890</P><P>1119_EFGH, Complete, 8/12/2020 2:00:00 PM, 67890</P></TD></TR></TBODY></TABLE> Fri, 18 Jun 2021 06:48:19 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-limit-the-transaction/m-p/556287#M157964 moinyuso96 2021-06-18T06:48:19Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-limit-the-transaction/m-p/556288#M157965 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/234296">@moinyuso96</a>,</P><P>as you can see in the documentation (<A href="https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchReference/Transaction" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchReference/Transaction</A>), it's possible to define the maximum number of events to correlate using "<SPAN>maxevents" option.</SPAN></P><P><SPAN>Ciao.</SPAN></P><P><SPAN>Giuseppe</SPAN></P> Fri, 18 Jun 2021 06:51:18 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-limit-the-transaction/m-p/556288#M157965 gcusello 2021-06-18T06:51:18Z