SPLK-1002 · Question #299
Consider the following search: index=web sourcetype=access_combined The log shows several events that share the same jsessionid value (sd497k117o2f098). View the events as a group. From the following
The correct answer is A. index=web sourcetype=access_combined | transaction JSESSIONID | search SD497K117O2F098. The objective is to group all events that share the same JSESSIONID value and filter them by a specific JSESSIONID. Option A: This uses the transaction command with the JSESSIONID field to group all events sharing the same session ID and filters for the specific value SD497K117O2
Question
Consider the following search: index=web sourcetype=access_combined The log shows several events that share the same jsessionid value (sd497k117o2f098). View the events as a group. From the following list, which search groups events by JSESSIONID?
Options
- Aindex=web sourcetype=access_combined | transaction JSESSIONID | search SD497K117O2F098
- Bindex=web sourcetype=access_combined JSESSIONID <sd497kl!7o2f098>
- Cindex=web sourcetype=access_combined | highlight JSESSIONID 'search SD497K117O2F098
- Dindex=web sourcetype=access_combined SD497K117O2F098 | table JSESSIONID
How the community answered
(29 responses)- A83% (24)
- B10% (3)
- C3% (1)
- D3% (1)
Explanation
The objective is to group all events that share the same JSESSIONID value and filter them by a specific JSESSIONID. Option A: This uses the transaction command with the JSESSIONID field to group all events sharing the same session ID and filters for the specific value SD497K117O2F098.
Topics
Community Discussion
No community discussion yet for this question.