Splunk Search

Why does increasing the value of maxopentxn reduce the number of returned transaction events?

gesman
Communicator

I run transaction command in the following manner:
... | transaction tlsid maxpause=15m maxevents=-1 keepevicted=1 mvlist=pages ...
It returns 14,776 events (transactions)

My limits.conf contains these settings:

[transactions]
maxopentxn    = 5000
maxopenevents = 100000

When I ran the same search, but with larger * maxopentxn *:
...| transaction tlsid maxpause=15m maxevents=-1 keepevicted=1 maxopentxn=1000000 mvlist=pages ...
- it returns 14,390 events

Why does increasing the limits reduce the number of transactions returned?
I expect same or bigger number, not smaller - my computer resources seems to be sufficient.

Tags (2)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

If you have a low number of open transactions, some will get closed when you hit that limit and new ones may get opened later in the search for the same tlsid. When you have a higher number of open transactions, these "split up" tlsid values will end up in one big combined transaction, giving you a lower overall number of transactions.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

If you have a low number of open transactions, some will get closed when you hit that limit and new ones may get opened later in the search for the same tlsid. When you have a higher number of open transactions, these "split up" tlsid values will end up in one big combined transaction, giving you a lower overall number of transactions.

gesman
Communicator

Great, thanks.

Gleb

0 Karma
Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...