The maxpause option of the transaction command in Splunk is used to specify the maximum time allowed between events in a transaction. If the time between events exceeds the maxpause value, those events are not considered part of the same transaction. Reference: Splunk Docs: transaction command Splunk Answers: maxpause option in transaction