Strange search behavior with "transaction"

[cnoulin]

Hello,
Could someone explain me the following strange behavior with search

With this type of search :

sourcetype="cisco:esa:textmail" | transaction internal_message_id | search "My_email_address@address.com"

When i make a search on last 15 minutes, last hour or last 4 hours, my search work and return me answers .

If i use a specified period time it work too.

As soon as i use 24hours or more, the search give me no answer.

How to explain this ?

Sorry for my english and thanks in advance

[aakwah · Accepted solution]

Add keepevicted=true to your query:

sourcetype="cisco:esa:textmail" | transaction internal_message_id keepevicted=true | search "My_email_address@address.com"

If you run a query that will generates a lot of events without it you will find a green exclamation mark beside "job" with this message:

Some transactions have been discarded. To include them, add keepevicted=true to your transaction command.

[cnoulin]

it work, perfect !
Thanks

[aakwah]

Welcome !

[somesoni2]

The transaction command is very resource expensive command. You're using very basic transaction command (not additional transaction limiting options being used) and based on your data, the virtual memory usage could be very high and due to search being finalized, it may not be returning any data. I would say, try using stats instead of transaction for your search.

http://docs.splunk.com/Documentation/Splunk/7.1.2/Search/Abouttransactions#Using_stats_instead_of_tr...

[cnoulin]

thank you for your answer.
I'm a splunk noob and try some differents syntax with the stat command but no one work...
Coulmd you help me and give me the syntax ?
I try different functions but no one work.

[cnoulin]

another thing.
The goal is to have a "unique" log entry when i visualize in splunk.
Actually ESA send me one line by log and the complete mail transaction is very difficult to analyse.
Mayube there is another solution to aggregate during indexing instead of during visualization ?

[niketn]

@cnoulin as @somesoni2 mentioned, stats is a better option for your use case. However, for us to assist you better you would need to provide more details on what fields and values you want to show after correlating them. If you lookup Splunk Answers you will find several examples.

sourcetype="cisco:esa:textmail" 
| stats count as eventCount min(_time) as _time max(_time) as LatestTime internal_message_id 
| eval duration=LatestTime-_time
| fields - LatestTime