What is the difference between maxspan and timelimit?

[kimmyb]

 the transaction is identified as jsessionid .the spl query to find all transactions which lasted less than 5 sec :

should i take :

*|transaction jsessionid maxspan=5

or 

*|transaction jsessionid timelimit=5

im finding it hard to see the different between them

or

we dont add maxspan or timelimit since it is less than 5 sec

[bowesmana]

@kimmyb 

Using transaction can generally be replaced with the stats command. transaction has numerous limitations if dealing with "long" transactions and larger data sets where the results you get cannot be reliable.

It is simple to use this basic stats replacement

search...
| stats min(_time) as min max(_time) as max by jsessionid
| where max-min<5

note that you can pass down any other fields you want, even "list(_raw)" in the stats to get all possible events.

or you can use streamstats, e.g.

| streamstats global=f range(_time) as range by jsessionid
| where range<5

 Neither of these have the limitations of transaction and will be reliable

[johnhuang]

| transaction jsessionid
| where duration<5

[FelixLeh]

| transaction jsessionid maxspan=5s means that the first and the last event the transaction is build with can't be further apart than 5 seconds. You can also set minutes or hours like this:
- maxspan=10m
- maxspan=1h

Edit:

As far as I know there is no timelimit option for the transaction command.
I also wasn't able to find it in the documentation for the command:

https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/Transaction

[kimmyb]

And if you can only chose  maxspan, timelimit , time , or nothing? 

In my exercise i could only take those? Where 3 are wrong 

[bowesmana]

As @FelixLeh pointed out, the maxspan is a valid option and will limit any transaction length to 5s. The others are not valid transaction options.

If the question is to find transactions less than 5 seconds, then maxspan it is

Read the man pages here - it should clarify

https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/Transaction#Txn_definition_option...