Knowledge Management

Transaction - evicted event because of large timespan?

kbarsl
Explorer

Given the data:
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"ChangeHandlers.WhatsOnOdPublicationChangeHandler.UpdatePublication","Host":"S04","TimeStamp":"2019-02-11T15:02:03.8031554+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"ChangeHandlers.WhatsOnOdPublicationChangeHandler.UpdatePublication","Host":"S01","TimeStamp":"2019-02-11T15:02:09.3830439+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"ChangeHandlers.WhatsOnOdPublicationChangeHandler.UpdatePublication","Host":"S03","TimeStamp":"2019-02-11T15:04:11.9023453+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"CommonServices.StateService.StateChange","Host":"S04","TimeStamp":"2019-02-11T15:12:50.5652496+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"ChangeHandlers.WhatsOnOdPublicationChangeHandler.UpdatePublication","Host":"S02","TimeStamp":"2019-02-12T06:12:46.7424158+01:00"}}

{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"ChangeHandlers.WhatsOnOdPublicationChangeHandler.CreatePublication","Host":"S01","TimeStamp":"2019-02-05T02:12:43.9264188+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"CommonServices.StateService.StateChange","Host":"S01","TimeStamp":"2019-02-05T02:12:44.6623886+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"CommonServices.StateService.StateChange","Host":"S02","TimeStamp":"2019-02-05T02:12:53.1139799+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"CommonServices.StateService.StateChange","Host":"S04","TimeStamp":"2019-02-05T02:13:54.3342244+01:00"}}

And my search:
index="myindex" Properties.PublicationType="Tv"
| transaction "Properties.CorrelationId" keepevicted=t mvlist=t
| search 00921908290

Returns:
2 events (1:first five, 2:last four) , where one event is marked as evicted (most recent).
It seems like the results are grouped pr date (_time) and NOT Properties.CorrelationId.

Am i doing something wrong?

Tags (1)
0 Karma
1 Solution

kbarsl
Explorer

maxopentxn=100000000 did the trick.

maxopentxn
Syntax: maxopentxn=
Description: Specifies the maximum number of not yet closed transactions to keep in the open pool before starting to evict transactions, using LRU policy.
Default: The default value for this argument is read from the transactions stanza in the limits.conf file.

Nothing was set up in the limits.conf, so i wonder what the default value is then?

View solution in original post

0 Karma

kbarsl
Explorer

maxopentxn=100000000 did the trick.

maxopentxn
Syntax: maxopentxn=
Description: Specifies the maximum number of not yet closed transactions to keep in the open pool before starting to evict transactions, using LRU policy.
Default: The default value for this argument is read from the transactions stanza in the limits.conf file.

Nothing was set up in the limits.conf, so i wonder what the default value is then?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

@kbarsl If your problem is resolved, please accept an answer to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

nickhills
Ultra Champion

Try using maxspan=7d or indeed maxpause=7d to see if that improves your results

index="myindex" Properties.PublicationType="Tv"
| transaction "Properties.CorrelationId" keepevicted=t mvlist=t maxspan=7d
| search 00921908290

https://docs.splunk.com/Documentation/Splunk/7.2.3/SearchReference/Transaction

If my comment helps, please give it a thumbs up!
0 Karma

kbarsl
Explorer

Tried both, even with 20d. Same results as before.
Seems like both parameters are meant for excluding, and not including.
Still can't figure out why my messages are being split up in 2 events. They all have the same CorrelationId.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...