What fields does the transaction command add to the raw events? (select all that apply)

The correct answer is B. duration D. transaction id. The transaction command enriches grouped events with additional computed fields. duration (B) is the time difference in seconds between the first and last event in the transaction. A transaction identifier field (D) is added when the name argument is used to label transactions…

Correlating Events

Question

Options

Acount
Bduration
Ceventcount
Dtransaction id

How the community answered

(26 responses)

A
4% (1)
B
85% (22)
C
12% (3)

Explanation

The transaction command enriches grouped events with additional computed fields. duration (B) is the time difference in seconds between the first and last event in the transaction. A transaction identifier field (D) is added when the name argument is used to label transactions, providing a reference ID for the grouped event set. While eventcount is also a well-known field added by the transaction command (tracking how many events are in the transaction), the exam identifies duration and the transaction identifier as the key fields tested here. Note: count is not added by the transaction command itself.

Topics

#transaction command#SPL commands#output fields#event correlation

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice