Splunk Search

Why are the same queries getting different result?

indeed_2000
Motivator

Hi

I have exactly two SPL, same date range, one with "tracnsaction" command another wirhout it.

as you see in picture without transaction timechart show correctly but with transaction last part missed!

FYI: 1-I've check log file correctly indexed and available.

2-pair of eachtransaction availabe in log in  missing part.

what happen here? any idea?

indeed_2000_0-1653987120971.png

 

Thanks

 

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

transaction is limited to the number of open transactions it processes (see limits.conf) - you can override this with maxopentxns - this defaults to 5000 (hence only 4999 events). For example:

| transaction correlationfield maxopentxn=10000

 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

transaction is limited to the number of open transactions it processes (see limits.conf) - you can override this with maxopentxns - this defaults to 5000 (hence only 4999 events). For example:

| transaction correlationfield maxopentxn=10000

 

gcusello
SplunkTrust
SplunkTrust

Hi @indeed_2000,

if you don't share your search and results I can only suppose something!

Anyway I think that the problem is that the transpose command uses as timestamp the first timestamp of the correlated events and probably all the events after 12.00 PM are in other grouped events.

But As I said it's difficoult withou  viewing your events.

To be sure, see if in the grouped events there are evevnts after 12.00 PM.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...