When using the transaction command, what does the argument maxspan do?
When using the transaction command, what does the argument maxspan do?
Maxspan sets the maximum total time between the earliest and latest events in a transaction. It ensures that the events within a transaction do not exceed the specified time span, thus maintaining relevant groupings of events that occur within a particular timeframe.
Correct answer is C
130 page of splk-1002. C is thee answer
maxspan -> first and last event maxpause -> between the events
I believe C as well
Answer is C: maxspan Syntax: maxspan=<int>[s | m | h | d] Description: Specifies the maximum length of time in seconds, minutes, hours, or days that the events can span. The events in the transaction must span less than integer specified for maxspan. Events that exceed the maxspan limit are treated as part of a separate transaction. If the value is negative, the maxspan constraint is disabled and there is no limit. Default: -1 (no limit)
C is correct
Correct answer is C
130 page of splk-1002. C is thee answer
Total time means start time+end time, i think max length make more sense so B is correct
B is the correct answer