Splunk Search

Why does increasing the value of maxopentxn reduce the number of returned transaction events?

gesman
Communicator

I run transaction command in the following manner:
... | transaction tlsid maxpause=15m maxevents=-1 keepevicted=1 mvlist=pages ...
It returns 14,776 events (transactions)

My limits.conf contains these settings:

[transactions]
maxopentxn    = 5000
maxopenevents = 100000

When I ran the same search, but with larger * maxopentxn *:
...| transaction tlsid maxpause=15m maxevents=-1 keepevicted=1 maxopentxn=1000000 mvlist=pages ...
- it returns 14,390 events

Why does increasing the limits reduce the number of transactions returned?
I expect same or bigger number, not smaller - my computer resources seems to be sufficient.

Tags (2)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

If you have a low number of open transactions, some will get closed when you hit that limit and new ones may get opened later in the search for the same tlsid. When you have a higher number of open transactions, these "split up" tlsid values will end up in one big combined transaction, giving you a lower overall number of transactions.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

If you have a low number of open transactions, some will get closed when you hit that limit and new ones may get opened later in the search for the same tlsid. When you have a higher number of open transactions, these "split up" tlsid values will end up in one big combined transaction, giving you a lower overall number of transactions.

gesman
Communicator

Great, thanks.

Gleb

0 Karma
Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...