How to Set Inactivity Timeout with maxpause in Splunk Transaction

Quick Answer

This question is testing precise knowledge of what maxpause actually measures: the maximum allowed gap of inactivity between one event and the next within a transaction, not the total length of the session. Because the requirement here is specifically about ending a session after 30 minutes of inactivity, the parameter needs to close the transaction after any pause reaches 30 minutes, which is exactly what maxpause=1800 does, since Splunk's time-based transaction parameters are expressed in seconds and 1800 seconds equals 30 minutes. This is different from a parameter that would cap the transaction's total duration regardless of activity level, which would end sessions based on elapsed time even if the user kept generating events continuously. Since the scenario cares about inactivity specifically, and doesn't place any limit on how long an active session can run, maxpause is the parameter that matches the stated requirement, while a total-duration limit would be solving a different problem. The general skill being tested is reading transaction parameter requirements carefully enough to tell inactivity-based boundaries apart from duration-based ones; whenever a scenario says a session or transaction should close after a period of no new activity, that's a maxpause question, and whenever it caps how long something is allowed to run in total, that's a different parameter entirely.