SPLK-1002 · Question #103
When using the transaction command, what does the argument maxspan do?
The correct answer is C. Sets the maximum total time between the earliest and latest events in a transaction. The 'maxspan' argument in Splunk's transaction command limits how long a transaction can last by capping the time between its first and last event.
Question
When using the transaction command, what does the argument maxspan do?
Options
- ASets the maximum total time between events in a transaction.
- BSets the maximum length of all events within a transaction.
- CSets the maximum total time between the earliest and latest events in a transaction.
- DSets the maximum length that any single event can reach to be included in the transaction.
How the community answered
(25 responses)- B4% (1)
- C96% (24)
Why each option
The 'maxspan' argument in Splunk's transaction command limits how long a transaction can last by capping the time between its first and last event.
The time between consecutive events within a transaction is controlled by 'maxpause', not maxspan.
maxspan does not refer to event length or character count; it is strictly a time duration argument.
maxspan sets the maximum total duration of a transaction, measured from the timestamp of the earliest event to the timestamp of the latest event included in that transaction. Any grouping that would exceed this total time span is split into separate transactions.
There is no argument in the transaction command that limits inclusion based on the length of a single event.
Concept tested: Splunk transaction command maxspan argument
Source: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction
Topics
Community Discussion
No community discussion yet for this question.