Splunk Search

Transaction command doesn't work for all events when the 'endswith' event is seen next day.

aishwaryabh
New Member

I am trying to run a transaction command for all the patrons where startswith=(Action=CardIn) endswith=(Action=CardOut). My query is:

index=* |
| transaction patron location startswith=Action=CardIn endswith=Action=CardOut keepevicted=t keeporphans=t maxspan=24h

It is not grouping the events together when CardIn event is in the afternoon and CardOut event at midnight.

maxspan doesn't seem to work here. I am using Splunk cloud instance. on specifying
the patron number in the search it works. However, on running it for all patrons it breaks.

I am running out of ideas, any help appreciated.

Tags (1)
0 Karma

to4kawa
Ultra Champion
index=your_index place=your_place
| streamstats count(eval(Action=="CardIn")) as CardIn 
| stats sum(CardIn)  by Patron_number

Hi, The search with transaction is too heavy.
We can improve if you have the expected results and the necessary sample logs on time.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

transaction is a heavy command, so is dependent on settings in limits.conf. There are other factors at play, such as maxopenevents/maxopentxn, the defaults are in limits.conf and in a default enterprise installation default to 100,000 and 5,000

These may be different in cloud. That may be relevant for you, but in general when things work at small scale and break at bigger scale, you are often coming up against Splunk default limits

0 Karma

rmmiller
Contributor

Are you sure your results for all patrons are coming back sorted in descending time order?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...