Splunk Search

Functionality of keepevicted not clear

rrovers
Communicator

I'm trying to understand the functionality of keepevicted. I've read several documentation about it but it's still not clear. 

I've made a search with transaction. Without keepevicted I get 54 events, with keepevicted 62. I've searched the difference and found 1 with let's say the text "abc". When I add "abc" to the search (in the first line with index=....) without keepevicted the event is returned. I don't understand why that is.

Can someone explain?

 

The search is something like this:

index=main sourcetype="src_type1" *abc* earliest=1610441880 latest=1610445533.859
| eval tmpId=if(len(bi_Id)>0,bi_Id,if(len(bo_id)>0,bo_id,be_Id))
| transaction maxspan=5s tmpId
| rex field=que1 "\{(?<cliber>.*)\}"
| rex field=que2 "\{(?<serber>.*)\}"
| stats count as Aantal by cliber

Labels (1)
0 Karma
1 Solution

sheamus69
Communicator

Hi,

If my memory serves me correctly, transactions can only look at a finite number of events - if that number is breached then the transaction is cancelled.

Splunk docs  for transactions show:

maxevents
    Syntax: maxevents=<int>
    Description: The maximum number of events in a transaction. If the value is negative this constraint is disabled.
    Default: 1000

 

Thus, when you add *ABC* to the start of the search, you are reducing the number of events that the transaction is searching through, compared to when you do not include *ABC*?

 

 

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

An "evicted" transaction is one which was not completed within the specified criteria.  In the example, if another event with the tmpId field was not found within 5 seconds of the previous such event then the current transaction is evicted.

---
If this reply helps you, Karma would be appreciated.

rrovers
Communicator

hi @richgalloway ,

Thanks for your answer but it's still not clear to me. I don't understand why the events with *abc* are not returned when I don't have *abc* in the first line.  When *abc* is in the first line and the rest of the search is the same as the first search the events are returned. 

0 Karma

sheamus69
Communicator

Hi,

If my memory serves me correctly, transactions can only look at a finite number of events - if that number is breached then the transaction is cancelled.

Splunk docs  for transactions show:

maxevents
    Syntax: maxevents=<int>
    Description: The maximum number of events in a transaction. If the value is negative this constraint is disabled.
    Default: 1000

 

Thus, when you add *ABC* to the start of the search, you are reducing the number of events that the transaction is searching through, compared to when you do not include *ABC*?

 

 

rrovers
Communicator

@sheamus69, thanks. I think you're right that this has to do with a limit. When I don't use keepevicted there is a limit of 4999 events. See also https://community.splunk.com/t5/Splunk-Search/Is-there-a-limit-on-the-number-of-events-returned-from... . With keepevicted there is no limit or it is much higher. 
The solution that works for me is to use keepevicted

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...