Hi,  I have a splunk query as below: index=platform env=sandbox http_method="GET" This gave me 1 result back. Now, when I am applying transaction command to it index=platform env=sandbox http_method="GET" | transaction startswith="GET" It is returning 0 results. 🤔 However, if I do like this: index=platform env=sandbox http_method="GET" | transaction startswith="GET" keepevicted=true It returns my 1 result back. Value of `closed_txn`  is 1. Also, if I do like below, still it returns my 1 result back. What is going on ? index=platform env=sandbox http_method="GET" | transaction CorrelationId startswith="GET"   "GET" is present in my event `_raw` otherwise  first search command would not have returned me 1 result.  ... View more

According to the splunk doc , eval can be used within aggregate functions with stats command like:   index=main sourcetype="access_combined_wcookie"| stats count(eval(action = "purchase")) AS "Total purchases"   Now, I was of opinion that eval is used to create a search result field and looking at the query , it seems    eval(action = "purchase")     will create a field with true/false as value. But this is not the case. It actually creates a search field with value 1/0 which the count() function then counts. This I did not found documented anywhere in eval splunk docs. Can some one help me point to resource where all such deviations for eval command from its normal behaviour are documented ? Are there more than this ? ... View more

Hi, I read from splunk docs that we should avoid using wildcards `*` in the middle of a string. Now, does this apply to  `%` wildcard used in `like()` too ? Ex:  like(some_field ,"abc%def") From my testing it seems , `%` is able to match punctuations too unlike `*`. ... View more