I am trying to run a transaction command for all the patrons where startswith=(Action=CardIn) endswith=(Action=CardOut). My query is:
index=* |
| transaction patron location startswith=Action=CardIn endswith=Action=CardOut keepevicted=t keeporphans=t maxspan=24h
It is not grouping the events together when CardIn event is in the afternoon and CardOut event at midnight.
maxspan doesn't seem to work here. I am using Splunk cloud instance. on specifying
the patron number in the search it works. However, on running it for all patrons it breaks.
I am running out of ideas, any help appreciated.
index=your_index place=your_place
| streamstats count(eval(Action=="CardIn")) as CardIn
| stats sum(CardIn) by Patron_number
Hi, The search with transaction
is too heavy.
We can improve if you have the expected results and the necessary sample logs on time.
transaction is a heavy command, so is dependent on settings in limits.conf. There are other factors at play, such as maxopenevents/maxopentxn, the defaults are in limits.conf and in a default enterprise installation default to 100,000 and 5,000
These may be different in cloud. That may be relevant for you, but in general when things work at small scale and break at bigger scale, you are often coming up against Splunk default limits
Are you sure your results for all patrons are coming back sorted in descending time order?