The maxspan option in the transaction command limits the maximum time span of the transaction to the specified duration, in this case, 5 minutes. This ensures that only events within that time window are grouped into one transaction. Reference: Splunk Power User Study Guide, Transaction Command Splunk Docs: transaction Command "maxspan sets the maximum time span allowed for transactions."