SPLK-1002 · Question #218
Consider the following search: index=web sourcetype=access_combined The log shows several events that share the same JSESSIONID value (SD470K92802F117). View the events as a group. From the following
The correct answer is B. index=web sourcetype=access_combined | transaction JSESSIONID | search. To group events by JSESSIONID, the correct search is index=web sourcetype=access_combined | transaction JSESSIONID | search SD470K92802F117 (Option B). The transaction command groups events that share the same JSESSIONID value, allowing for the analysis of all events associated w
Question
Consider the following search:
index=web sourcetype=access_combined The log shows several events that share the same JSESSIONID value (SD470K92802F117). View the events as a group. From the following list, which search groups events by JSESSIONID?
Options
- Aindex=web sourcetype=access_combined | highlight JSESSIONID | search SD470K92802F117
- Bindex=web sourcetype=access_combined | transaction JSESSIONID | search
- Cindex=web sourcetype=access_combined SD470K92802F117 | table JSESSIONID
- Dindex=web sourcetype=access_combined JSESSIONID <SD470K92802F117>
How the community answered
(60 responses)- A2% (1)
- B93% (56)
- C3% (2)
- D2% (1)
Explanation
To group events by JSESSIONID, the correct search is index=web sourcetype=access_combined | transaction JSESSIONID | search SD470K92802F117 (Option B). The transaction command groups events that share the same JSESSIONID value, allowing for the analysis of all events associated with a specific session as a single transaction. The subsequent search for SD470K92802F117 filters these grouped transactions to include only those related to the specified session ID.
Topics
Community Discussion
No community discussion yet for this question.