Splunk Search

Is there a limit on "Show all lines" in transaction startswith and endswith?

carlyleadmin
Contributor

Hi All,

I am using transaction with startswith endswith and some files are not showing. So I used keepevicted=t and my question is that is there a limit on "Show all lines"alt text

I see a pattern with all the evicted files, they are all limited to either "show all lines 1007 or 1000", so I suspect that there might be a limit? Can anyone confirm this because it affects the results of my search? It always skips the startswith value that I have set in my query and my endswith value is always showing up at the end.

thanks

0 Karma
1 Solution

carlyleadmin
Contributor

Well there is a limit and by adding maxevents at the end of my query it is resolved

View solution in original post

0 Karma

carlyleadmin
Contributor

Well there is a limit and by adding maxevents at the end of my query it is resolved

0 Karma

carlyleadmin
Contributor

Well there is a limit and by adding maxevents at the end of my query it is resolved

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>