Why would the transaction command be used instead of the stats command?

The correct answer is C. The transaction command keeps the raw data for each event.. The key advantage of the transaction command over stats is that it preserves the raw event data (_raw) for every event in the transaction group. This allows analysts to inspect the individual events that make up a grouped session (e.g., a web session or multi-step process). The s

Basic Transforming Commands

Question

Options

AThe transaction command has better search-time performance.
BThe transaction command can perform calculations on fields.
CThe transaction command keeps the raw data for each event.
DThe transaction command is less resource-intensive.

How the community answered

(40 responses)

A
3% (1)
B
5% (2)
C
90% (36)
D
3% (1)

Explanation

The key advantage of the transaction command over stats is that it preserves the raw event data (_raw) for every event in the transaction group. This allows analysts to inspect the individual events that make up a grouped session (e.g., a web session or multi-step process). The stats command, by contrast, aggregates and summarizes fields, discarding the original raw events. transaction is actually more resource-intensive than stats (eliminating options A and D). Both commands can reference fields, but only stats performs true aggregation calculations (eliminating option B).

Topics

#transaction command#stats command#event grouping#raw data preservation

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice