Splunk Search
Highlighted

Is there a limit on "Show all lines" in transaction startswith and endswith?

Contributor

Hi All,

I am using transaction with startswith endswith and some files are not showing. So I used keepevicted=t and my question is that is there a limit on "Show all lines"alt text

I see a pattern with all the evicted files, they are all limited to either "show all lines 1007 or 1000", so I suspect that there might be a limit? Can anyone confirm this because it affects the results of my search? It always skips the startswith value that I have set in my query and my endswith value is always showing up at the end.

thanks

0 Karma
Highlighted

Re: Is there a limit on "Show all lines" in transaction startswith and endswith?

Contributor

Well there is a limit and by adding maxevents at the end of my query it is resolved

0 Karma

Re: Is there a limit on "Show all lines" in transaction startswith and endswith?

Contributor

Well there is a limit and by adding maxevents at the end of my query it is resolved

View solution in original post

0 Karma