I use this transaction statement: transaction taskId maxpause=120m maxevents=30000 mvlist=state_change I'm still tuning the maxpause and maxevents parameters based on real transactions. These are tasks running in a task scheduler. Some of them are really long and contain lots of steps. Most of them are ready running within a few minutes, but is specific cases (error situation) a task does not end correctly and stays as a kind of zombie in the system (hence the long maxpause). It's a bit brute force, but Splunk seems to handle this pretty wel 🙂 ... View more