Transaction - evicted event because of large timespan?

[kbarsl]

Given the data:
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"ChangeHandlers.WhatsOnOdPublicationChangeHandler.UpdatePublication","Host":"S04","TimeStamp":"2019-02-11T15:02:03.8031554+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"ChangeHandlers.WhatsOnOdPublicationChangeHandler.UpdatePublication","Host":"S01","TimeStamp":"2019-02-11T15:02:09.3830439+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"ChangeHandlers.WhatsOnOdPublicationChangeHandler.UpdatePublication","Host":"S03","TimeStamp":"2019-02-11T15:04:11.9023453+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"CommonServices.StateService.StateChange","Host":"S04","TimeStamp":"2019-02-11T15:12:50.5652496+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"ChangeHandlers.WhatsOnOdPublicationChangeHandler.UpdatePublication","Host":"S02","TimeStamp":"2019-02-12T06:12:46.7424158+01:00"}}

{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"ChangeHandlers.WhatsOnOdPublicationChangeHandler.CreatePublication","Host":"S01","TimeStamp":"2019-02-05T02:12:43.9264188+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"CommonServices.StateService.StateChange","Host":"S01","TimeStamp":"2019-02-05T02:12:44.6623886+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"CommonServices.StateService.StateChange","Host":"S02","TimeStamp":"2019-02-05T02:12:53.1139799+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"CommonServices.StateService.StateChange","Host":"S04","TimeStamp":"2019-02-05T02:13:54.3342244+01:00"}}

And my search:
index="myindex" Properties.PublicationType="Tv"
| transaction "Properties.CorrelationId" keepevicted=t mvlist=t
| search 00921908290

Returns:
2 events (1:first five, 2:last four) , where one event is marked as evicted (most recent).
It seems like the results are grouped pr date (_time) and NOT Properties.CorrelationId.

Am i doing something wrong?

[kbarsl · Accepted solution]

maxopentxn=100000000 did the trick.

maxopentxn
Syntax: maxopentxn=
Description: Specifies the maximum number of not yet closed transactions to keep in the open pool before starting to evict transactions, using LRU policy.
Default: The default value for this argument is read from the transactions stanza in the limits.conf file.

Nothing was set up in the limits.conf, so i wonder what the default value is then?

[richgalloway]

@kbarsl If your problem is resolved, please accept an answer to help future readers.

[nickhills]

Try using maxspan=7d or indeed maxpause=7d to see if that improves your results

index="myindex" Properties.PublicationType="Tv"
| transaction "Properties.CorrelationId" keepevicted=t mvlist=t maxspan=7d
| search 00921908290

https://docs.splunk.com/Documentation/Splunk/7.2.3/SearchReference/Transaction

[kbarsl]

Tried both, even with 20d. Same results as before.
Seems like both parameters are meant for excluding, and not including.
Still can't figure out why my messages are being split up in 2 events. They all have the same CorrelationId.