Transaction command doesn't work for all events when the 'endswith' event is seen next day.

[aishwaryabh]

I am trying to run a transaction command for all the patrons where startswith=(Action=CardIn) endswith=(Action=CardOut). My query is:

index=* |
| transaction patron location startswith=Action=CardIn endswith=Action=CardOut keepevicted=t keeporphans=t maxspan=24h

It is not grouping the events together when CardIn event is in the afternoon and CardOut event at midnight.

maxspan doesn't seem to work here. I am using Splunk cloud instance. on specifying
the patron number in the search it works. However, on running it for all patrons it breaks.

I am running out of ideas, any help appreciated.

[to4kawa]

index=your_index place=your_place
| streamstats count(eval(Action=="CardIn")) as CardIn 
| stats sum(CardIn)  by Patron_number

Hi, The search with transaction is too heavy.
We can improve if you have the expected results and the necessary sample logs on time.

[bowesmana]

transaction is a heavy command, so is dependent on settings in limits.conf. There are other factors at play, such as maxopenevents/maxopentxn, the defaults are in limits.conf and in a default enterprise installation default to 100,000 and 5,000

These may be different in cloud. That may be relevant for you, but in general when things work at small scale and break at bigger scale, you are often coming up against Splunk default limits

[rmmiller]

Are you sure your results for all patrons are coming back sorted in descending time order?