* The transaction command is a Splunk command that finds transactions based on events that meet various constraints1.
* Transactions are made up of the raw text (the _raw field) of each member, the time and date fields of the earliest member, as well as the union of all other fields of each member1.
* The transaction command adds some fields to the raw events that are part of the transaction12. These fields are:
* duration: The difference, in seconds, between the timestamps for the first and last events in the transaction12.
* eventcount: The number of events in the transaction12.
* closed_txn: A Boolean field that indicates whether the transaction is closed or evicted2. A transaction is closed if it meets one of the following conditions: maxevents, maxpause, maxspan, or startswith2. A transaction is evicted if it does not meet any of these conditions and exceeds the memory limit specified by maxopentxn or maxopenevents23.
* Therefore, evicted transactions can be distinguished from non-evicted transactions by checking the value of the closed_txn field. The closed_txn field is set to 0, or false, for evicted transactions and 1, or true for non-evicted, or closed, transactions23.