Splunk Search

Transaction failures

twinspop
Influencer

Trying to get a transaction search to work. The transaction is logged in 2 different log sources, with the matching field named differently in each. I use rename to match them up. The DXI events have CORRELATIONID, the sendMessage events have msgid.

I manually found 1 that I know exists and searched for its GUID explicitly, along with the 2 identifiers I'll use in the generic search, and piped them into transaction. The maxspan is 130m because the test transaction takes about 123m to complete.

(DXI OR sendMessage) 652F5692-5F3F-3434-F47B-180BA1CBDDEF | rename CORRELATIONID as msgid | transaction msgid keepevicted=true maxspan=130m

1 transaction returned with an eventcount of 2. Exactly the result I expected. Now let's remove the GUID and see all of them:

DXI OR sendMessage | rename CORRELATIONID as msgid | transaction msgid keepevicted=true maxspan=130m

Nope. Not even the test case above is matched. Same time frame searched. What am I missing? There are ~ 90k msgid matches in the target time frame. Too many to run a transaction against with defaults limits set?

Thanks

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Yes. Try setting the maxopentxn parameter as a transaction argument. By default, it will only leave open 5000 transactions. Feel free to raise it to several hundred thousand or higher. You might also want to raise maxopenevents.

Also, if you just want the eventcount or some other fields in the events, rather than the full event, use stats:

 ... | stats count as evencount, max(_time) as endtime, min(_time) as starttime, first(otherfield) as otherfield by msgid

I'm assuming that since msgids are GUIDs, the maxspan doesn't matter at all, and could be infinite.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

Yes. Try setting the maxopentxn parameter as a transaction argument. By default, it will only leave open 5000 transactions. Feel free to raise it to several hundred thousand or higher. You might also want to raise maxopenevents.

Also, if you just want the eventcount or some other fields in the events, rather than the full event, use stats:

 ... | stats count as evencount, max(_time) as endtime, min(_time) as starttime, first(otherfield) as otherfield by msgid

I'm assuming that since msgids are GUIDs, the maxspan doesn't matter at all, and could be infinite.

twinspop
Influencer

Excellent. Thanks.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...