Splunk Search

Why does increasing the value of maxopentxn reduce the number of returned transaction events?

gesman
Communicator

I run transaction command in the following manner:
... | transaction tlsid maxpause=15m maxevents=-1 keepevicted=1 mvlist=pages ...
It returns 14,776 events (transactions)

My limits.conf contains these settings:

[transactions]
maxopentxn    = 5000
maxopenevents = 100000

When I ran the same search, but with larger * maxopentxn *:
...| transaction tlsid maxpause=15m maxevents=-1 keepevicted=1 maxopentxn=1000000 mvlist=pages ...
- it returns 14,390 events

Why does increasing the limits reduce the number of transactions returned?
I expect same or bigger number, not smaller - my computer resources seems to be sufficient.

Tags (2)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

If you have a low number of open transactions, some will get closed when you hit that limit and new ones may get opened later in the search for the same tlsid. When you have a higher number of open transactions, these "split up" tlsid values will end up in one big combined transaction, giving you a lower overall number of transactions.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

If you have a low number of open transactions, some will get closed when you hit that limit and new ones may get opened later in the search for the same tlsid. When you have a higher number of open transactions, these "split up" tlsid values will end up in one big combined transaction, giving you a lower overall number of transactions.

gesman
Communicator

Great, thanks.

Gleb

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...