Archive

Transaction - evicted event because of large timespan?

Explorer

Given the data:
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"ChangeHandlers.WhatsOnOdPublicationChangeHandler.UpdatePublication","Host":"S04","TimeStamp":"2019-02-11T15:02:03.8031554+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"ChangeHandlers.WhatsOnOdPublicationChangeHandler.UpdatePublication","Host":"S01","TimeStamp":"2019-02-11T15:02:09.3830439+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"ChangeHandlers.WhatsOnOdPublicationChangeHandler.UpdatePublication","Host":"S03","TimeStamp":"2019-02-11T15:04:11.9023453+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"CommonServices.StateService.StateChange","Host":"S04","TimeStamp":"2019-02-11T15:12:50.5652496+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"ChangeHandlers.WhatsOnOdPublicationChangeHandler.UpdatePublication","Host":"S02","TimeStamp":"2019-02-12T06:12:46.7424158+01:00"}}

{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"ChangeHandlers.WhatsOnOdPublicationChangeHandler.CreatePublication","Host":"S01","TimeStamp":"2019-02-05T02:12:43.9264188+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"CommonServices.StateService.StateChange","Host":"S01","TimeStamp":"2019-02-05T02:12:44.6623886+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"CommonServices.StateService.StateChange","Host":"S02","TimeStamp":"2019-02-05T02:12:53.1139799+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"CommonServices.StateService.StateChange","Host":"S04","TimeStamp":"2019-02-05T02:13:54.3342244+01:00"}}

And my search:
index="myindex" Properties.PublicationType="Tv"
| transaction "Properties.CorrelationId" keepevicted=t mvlist=t
| search 00921908290

Returns:
2 events (1:first five, 2:last four) , where one event is marked as evicted (most recent).
It seems like the results are grouped pr date (_time) and NOT Properties.CorrelationId.

Am i doing something wrong?

Tags (1)
0 Karma
1 Solution

Explorer

maxopentxn=100000000 did the trick.

maxopentxn
Syntax: maxopentxn=
Description: Specifies the maximum number of not yet closed transactions to keep in the open pool before starting to evict transactions, using LRU policy.
Default: The default value for this argument is read from the transactions stanza in the limits.conf file.

Nothing was set up in the limits.conf, so i wonder what the default value is then?

View solution in original post

0 Karma

Explorer

maxopentxn=100000000 did the trick.

maxopentxn
Syntax: maxopentxn=
Description: Specifies the maximum number of not yet closed transactions to keep in the open pool before starting to evict transactions, using LRU policy.
Default: The default value for this argument is read from the transactions stanza in the limits.conf file.

Nothing was set up in the limits.conf, so i wonder what the default value is then?

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

@kbarsl If your problem is resolved, please accept an answer to help future readers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Ultra Champion

Try using maxspan=7d or indeed maxpause=7d to see if that improves your results

index="myindex" Properties.PublicationType="Tv"
| transaction "Properties.CorrelationId" keepevicted=t mvlist=t maxspan=7d
| search 00921908290

https://docs.splunk.com/Documentation/Splunk/7.2.3/SearchReference/Transaction

0 Karma

Explorer

Tried both, even with 20d. Same results as before.
Seems like both parameters are meant for excluding, and not including.
Still can't figure out why my messages are being split up in 2 events. They all have the same CorrelationId.

0 Karma