Are there any restrictions for the transaction command which are specified in limits.conf?

[danielbb]

Our transaction period can cover five to six days covering sessions by users connected to the company's network. Are there any configurations set-up in limits.conf that we need to be aware of, when we use the transaction command?

[to4kawa · Accepted solution]

see reference:

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf#.5Btransactions.5D

[danielbb]

That's nice - the limit.conf documentation refers to two parameters for the transaction command - maxopentxn and maxopenevents. maxopentxn might be applicable to us. In case transactions are being evicted from the pool, will we see references to them via the UI or/and in the log files?

[to4kawa]

search.log:

05-17-2020 07:22:25.942 INFO  NewTransam - evicted=0, closed=1000, event_count=1000000, candidate_events=999000, comparison_count=999998

sample:

| makeresults count=1000000
| streamstats count as A
| eval A=A % 2
| streamstats count as B
| transaction A

There is no display on job.

[danielbb]

Very nice @to4kawa !

[to4kawa]

Do you have to use transaction ?

[danielbb]

It can be stats, but we would like to understand transaction and its limits.