What are the results from the transaction command when keepevicted=true?

The keepevicted parameter in the transaction command controls whether evicted transactions are included in the search results. Evicted transactions are those that were not completed within specified constraints like maxspan, maxpause, or maxevents.

According to Splunk Documentation:

"keepevicted: Whether to output evicted transactions. Evicted transactions can be distinguished from non-evicted transactions by checking the value of the 'closed_txn' field."

"The 'closed_txn' field is set to '0' for evicted transactions and '1' for closed transactions."

By setting keepevicted=true, you ensure that these incomplete or failed transactions are included in your search results, allowing for comprehensive analysis.