Splunk
SPLK-1002 · Question #210
When would transaction be used instead of stats?
The correct answer is D. To group events based on start/end values. The transaction command is used to group events that are related by some common fields or conditions, such as start/end values, time span, or pauses. The stats command is used to calculate statistics on a group of events by a common field value.
Correlating Events
Question
When would transaction be used instead of stats?
Options
- ATo group events based on a single field value.
- BTo see results of a calculation.
- CTo have a faster and more efficient search.
- DTo group events based on start/end values.
How the community answered
(37 responses)- A3% (1)
- B3% (1)
- C5% (2)
- D89% (33)
Explanation
The transaction command is used to group events that are related by some common fields or conditions, such as start/end values, time span, or pauses. The stats command is used to calculate statistics on a group of events by a common field value.
Topics
#transaction command#stats command#event grouping#command comparison
Community Discussion
No community discussion yet for this question.