However, the number of events returned from the second command is:
Is there a limit somewhere which prevents me from having all of the events in the transaction? I have various messages coming in which update the status of the event and it is possible that these messages may come in out of order.
It is actually a limit of the number of open transaction handles. The parameters (also in limits.conf) is maxopentxn. Playing with this variables, though, seems to have crashed my splunkd. I think I am going to have to seek an alternative to transactions for what I want to do. I really just want to combine events which have the same ID, so maybe dedup will allow me to do that.