Splunk Search
Highlighted

Strange search behavior with "transaction"

Explorer

Hello,
Could someone explain me the following strange behavior with search

With this type of search :

sourcetype="cisco:esa:textmail" | transaction internalmessageid | search "Myemailaddress@address.com"

When i make a search on last 15 minutes, last hour or last 4 hours, my search work and return me answers .

If i use a specified period time it work too.

As soon as i use 24hours or more, the search give me no answer.

How to explain this ?

Sorry for my english and thanks in advance

Tags (2)
0 Karma
Highlighted

Re: Strange search behavior with "transaction"

SplunkTrust
SplunkTrust

The transaction command is very resource expensive command. You're using very basic transaction command (not additional transaction limiting options being used) and based on your data, the virtual memory usage could be very high and due to search being finalized, it may not be returning any data. I would say, try using stats instead of transaction for your search.

http://docs.splunk.com/Documentation/Splunk/7.1.2/Search/Abouttransactions#Using_stats_instead_of_tr...

0 Karma
Highlighted

Re: Strange search behavior with "transaction"

Explorer

thank you for your answer.
I'm a splunk noob and try some differents syntax with the stat command but no one work...
Coulmd you help me and give me the syntax ?
I try different functions but no one work.

0 Karma
Highlighted

Re: Strange search behavior with "transaction"

Explorer

another thing.
The goal is to have a "unique" log entry when i visualize in splunk.
Actually ESA send me one line by log and the complete mail transaction is very difficult to analyse.
Mayube there is another solution to aggregate during indexing instead of during visualization ?

0 Karma
Highlighted

Re: Strange search behavior with "transaction"

Legend

@cnoulin as @somesoni2 mentioned, stats is a better option for your use case. However, for us to assist you better you would need to provide more details on what fields and values you want to show after correlating them. If you lookup Splunk Answers you will find several examples.

sourcetype="cisco:esa:textmail" 
| stats count as eventCount min(_time) as _time max(_time) as LatestTime internal_message_id 
| eval duration=LatestTime-_time
| fields - LatestTime



| eval message="Happy Splunking!!!"


0 Karma
Highlighted

Re: Strange search behavior with "transaction"

Builder

Add keepevicted=true to your query:

sourcetype="cisco:esa:textmail" | transaction internal_message_id keepevicted=true | search "My_email_address@address.com"

If you run a query that will generates a lot of events without it you will find a green exclamation mark beside "job" with this message:

Some transactions have been discarded. To include them, add keepevicted=true to your transaction command.

View solution in original post

0 Karma
Highlighted

Re: Strange search behavior with "transaction"

Explorer

it work, perfect !
Thanks

Highlighted

Re: Strange search behavior with "transaction"

Builder

Welcome !

0 Karma