SPLK-1002 · Question #237
Which of the following statements describes the command below (select all that apply) Sourcetype=access_combined | transaction JSESSIONID
The correct answer is B. An additional field named duration is created. C. An additional field named eventcount is created. D. Events with the same JSESSIONID will be grouped together into a single event. The command sourcetype=access_combined | transaction JSESSIONID does three things: It filters the events by the sourcetype access_combined, which is a predefined sourcetype for Apache web server logs. It groups the events by the field JSESSIONID, which is a unique identifier…
Question
Which of the following statements describes the command below (select all that apply) Sourcetype=access_combined | transaction JSESSIONID
Options
- AAn additional filed named maxspan is created.
- BAn additional field named duration is created.
- CAn additional field named eventcount is created.
- DEvents with the same JSESSIONID will be grouped together into a single event.
How the community answered
(19 responses)- A16% (3)
- B84% (16)
Explanation
The command sourcetype=access_combined | transaction JSESSIONID does three things: It filters the events by the sourcetype access_combined, which is a predefined sourcetype for Apache web server logs. It groups the events by the field JSESSIONID, which is a unique identifier for each user session. It creates a single event from each group of events that share the same JSESSIONID value. This single event will have some additional fields created by the transaction command, such as duration, eventcount, and startime.
Topics
Community Discussion
No community discussion yet for this question.