Splunk Search

Functionality of keepevicted not clear

rrovers
Communicator

I'm trying to understand the functionality of keepevicted. I've read several documentation about it but it's still not clear. 

I've made a search with transaction. Without keepevicted I get 54 events, with keepevicted 62. I've searched the difference and found 1 with let's say the text "abc". When I add "abc" to the search (in the first line with index=....) without keepevicted the event is returned. I don't understand why that is.

Can someone explain?

 

The search is something like this:

index=main sourcetype="src_type1" *abc* earliest=1610441880 latest=1610445533.859
| eval tmpId=if(len(bi_Id)>0,bi_Id,if(len(bo_id)>0,bo_id,be_Id))
| transaction maxspan=5s tmpId
| rex field=que1 "\{(?<cliber>.*)\}"
| rex field=que2 "\{(?<serber>.*)\}"
| stats count as Aantal by cliber

Labels (1)
0 Karma
1 Solution

sheamus69
Communicator

Hi,

If my memory serves me correctly, transactions can only look at a finite number of events - if that number is breached then the transaction is cancelled.

Splunk docs  for transactions show:

maxevents
    Syntax: maxevents=<int>
    Description: The maximum number of events in a transaction. If the value is negative this constraint is disabled.
    Default: 1000

 

Thus, when you add *ABC* to the start of the search, you are reducing the number of events that the transaction is searching through, compared to when you do not include *ABC*?

 

 

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

An "evicted" transaction is one which was not completed within the specified criteria.  In the example, if another event with the tmpId field was not found within 5 seconds of the previous such event then the current transaction is evicted.

---
If this reply helps you, Karma would be appreciated.
0 Karma

rrovers
Communicator

hi @richgalloway ,

Thanks for your answer but it's still not clear to me. I don't understand why the events with *abc* are not returned when I don't have *abc* in the first line.  When *abc* is in the first line and the rest of the search is the same as the first search the events are returned. 

0 Karma

sheamus69
Communicator

Hi,

If my memory serves me correctly, transactions can only look at a finite number of events - if that number is breached then the transaction is cancelled.

Splunk docs  for transactions show:

maxevents
    Syntax: maxevents=<int>
    Description: The maximum number of events in a transaction. If the value is negative this constraint is disabled.
    Default: 1000

 

Thus, when you add *ABC* to the start of the search, you are reducing the number of events that the transaction is searching through, compared to when you do not include *ABC*?

 

 

rrovers
Communicator

@sheamus69, thanks. I think you're right that this has to do with a limit. When I don't use keepevicted there is a limit of 4999 events. See also https://community.splunk.com/t5/Splunk-Search/Is-there-a-limit-on-the-number-of-events-returned-from... . With keepevicted there is no limit or it is much higher. 
The solution that works for me is to use keepevicted

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...