Splunk
SPLK-1002 · Question #261
When using transaction, what is the default maximum span between events?
The correct answer is A. Unlimited. When using the transaction command in Splunk, the default maximum span between events is set to unlimited. This is indicated by the default value of maxspan=-1, which corresponds to an "all time" time range.
Correlating Events
Question
When using transaction, what is the default maximum span between events?
Options
- AUnlimited
- B1h
- C1m
- D1d
How the community answered
(42 responses)- A95% (40)
- C2% (1)
- D2% (1)
Explanation
When using the transaction command in Splunk, the default maximum span between events is set to unlimited. This is indicated by the default value of maxspan=-1, which corresponds to an "all time" time range.
Topics
#transaction command#event correlation#default behavior#maxspan
Community Discussion
No community discussion yet for this question.