<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Is there any limit for field value for the transaction command? in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/Is-there-any-limit-for-field-value-for-the-transaction-command/m-p/315741#M94502</link>
    <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;Is there any limit for field value for transaction command?&lt;/P&gt;

&lt;P&gt;I am executing transaction command over Security_ID field but Splunk is grouping events where  Security_ID is different. For example:&lt;/P&gt;

&lt;P&gt;Security_ID&lt;BR /&gt;
    S-1-5-21-1275861439-237309362-10498456-49961&lt;BR /&gt;&lt;BR /&gt;
        S-1-5-21-1275861439-237309362-10498456-51020&lt;/P&gt;

&lt;P&gt;Best regards&lt;/P&gt;</description>
    <pubDate>Tue, 29 Sep 2020 18:53:50 GMT</pubDate>
    <dc:creator>apezuela</dc:creator>
    <dc:date>2020-09-29T18:53:50Z</dc:date>
    <item>
      <title>Is there any limit for field value for the transaction command?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Is-there-any-limit-for-field-value-for-the-transaction-command/m-p/315741#M94502</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;Is there any limit for field value for transaction command?&lt;/P&gt;

&lt;P&gt;I am executing transaction command over Security_ID field but Splunk is grouping events where  Security_ID is different. For example:&lt;/P&gt;

&lt;P&gt;Security_ID&lt;BR /&gt;
    S-1-5-21-1275861439-237309362-10498456-49961&lt;BR /&gt;&lt;BR /&gt;
        S-1-5-21-1275861439-237309362-10498456-51020&lt;/P&gt;

&lt;P&gt;Best regards&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 18:53:50 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Is-there-any-limit-for-field-value-for-the-transaction-command/m-p/315741#M94502</guid>
      <dc:creator>apezuela</dc:creator>
      <dc:date>2020-09-29T18:53:50Z</dc:date>
    </item>
    <item>
      <title>Re: Is there any limit for field value for the transaction command?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Is-there-any-limit-for-field-value-for-the-transaction-command/m-p/315742#M94503</link>
      <description>&lt;P&gt;Can you share sample data and search query you are running?&lt;/P&gt;</description>
      <pubDate>Fri, 06 Apr 2018 11:23:39 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Is-there-any-limit-for-field-value-for-the-transaction-command/m-p/315742#M94503</guid>
      <dc:creator>p_gurav</dc:creator>
      <dc:date>2018-04-06T11:23:39Z</dc:date>
    </item>
    <item>
      <title>Re: Is there any limit for field value for the transaction command?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Is-there-any-limit-for-field-value-for-the-transaction-command/m-p/315743#M94504</link>
      <description>&lt;P&gt;Please could you elaborate what you are trying to do with the Transaction command.  Are you trying to group events based on Secure_ID, if that is the case, I don'e think you will need Transactions command in the first place&lt;/P&gt;</description>
      <pubDate>Fri, 06 Apr 2018 11:57:07 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Is-there-any-limit-for-field-value-for-the-transaction-command/m-p/315743#M94504</guid>
      <dc:creator>sarvan7777</dc:creator>
      <dc:date>2018-04-06T11:57:07Z</dc:date>
    </item>
    <item>
      <title>Re: Is there any limit for field value for the transaction command?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Is-there-any-limit-for-field-value-for-the-transaction-command/m-p/315744#M94505</link>
      <description>&lt;P&gt;&lt;CODE&gt;stats&lt;/CODE&gt; would be a better approach than &lt;CODE&gt;transaction&lt;/CODE&gt;&lt;/P&gt;</description>
      <pubDate>Fri, 06 Apr 2018 16:05:21 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Is-there-any-limit-for-field-value-for-the-transaction-command/m-p/315744#M94505</guid>
      <dc:creator>skoelpin</dc:creator>
      <dc:date>2018-04-06T16:05:21Z</dc:date>
    </item>
  </channel>
</rss>

