SPLK-1002 · Question #112
When should transaction be used?
The correct answer is C. When event grouping is based on start/end values.. The transaction command is most appropriate when event grouping logic depends on start and end conditions, such as session boundaries, rather than simple field-value aggregation.
Question
When should transaction be used?
Options
- AOnly in a large distributed Splunk environment.
- BWhen calculating results from one or more fields.
- CWhen event grouping is based on start/end values.
- DWhen grouping events results in over 1000 events in each group.
How the community answered
(51 responses)- A2% (1)
- B4% (2)
- C92% (47)
- D2% (1)
Why each option
The transaction command is most appropriate when event grouping logic depends on start and end conditions, such as session boundaries, rather than simple field-value aggregation.
The transaction command is not restricted to distributed Splunk environments; it works in any deployment but is resource-intensive.
Calculating results from one or more fields is the role of the stats command, which is more efficient for pure aggregation.
The transaction command is designed for scenarios where related events must be grouped based on start and end conditions (for example, a session beginning with a login and ending with a logout). It preserves raw event data within groups and supports startswith/endswith arguments that stats cannot replicate.
Group size does not determine when to use transaction; performance considerations actually discourage using it for very large event groups.
Concept tested: Splunk transaction command appropriate use cases
Source: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction
Topics
Community Discussion
No community discussion yet for this question.