The transaction command groups related events based on shared field values. The maxspan argument specifies the maximum time span allowed between the earliest and latest events in a transaction.
Extract:“Use the maxspan argument to specify the maximum duration of a transaction. Events that exceed this time span are not grouped into the same transaction.”
Therefore, transaction user host maxspan=15s groups events by user and host only when they occur within 15 seconds of each other.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit