nerdexam
Splunk

SPLK-1002 · Question #216

When would transaction be used instead of stats?

The correct answer is B. To group events based on start/end values. The transaction command is used instead of stats to group events based on start/end values (Option B). This is particularly useful in scenarios where related events span across multiple log entries and need to be analyzed as a single transaction, such as user sessions or…

Correlating Events

Question

When would transaction be used instead of stats?

Options

  • ATo see results of a calculation.
  • BTo group events based on start/end values.
  • CTo have a faster and more efficient search.
  • DTo group events based on a single field value.

How the community answered

(39 responses)
  • A
    3% (1)
  • B
    95% (37)
  • D
    3% (1)

Explanation

The transaction command is used instead of stats to group events based on start/end values (Option B). This is particularly useful in scenarios where related events span across multiple log entries and need to be analyzed as a single transaction, such as user sessions or multi-step transaction processes.

Topics

#transaction command#stats command#event correlation#grouping events

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice