All Apps and Add-ons

Best way to use transaction method efficiently

Path Finder


I'm dealing with cisco::esa (Ironport) logs that comes from 4 different ESA devices.

What I'm trying to do is; by using transaction method, grouping events and reporting them based on grouped data. (Each transaction approximately consists of 15-17 different events) and my challenge is data is huge (montly data, ~3M mail ) and I'm using a standalone box with 24 Gb RAM and 12 CPU.

When I run the command like written in transaction documentation, I see that query stucked at some point, not all events are combined correctly and results are inconsistent. As far as I read from this forum, It looks like a scalability issue of transaction.

What's your recommendation?

My query is like this; sourcetype=cisco::esa| transaction custom_mid icid dcid maxevenst=20

PS: custom_mid is a special variable I created since I'm using 4 different log source of Cisco ESA devices, MID values sometimes collapses. So I created custom_mid like: IPofDevice+MID


0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...