SPLK-1002 · Question #6
SPLK-1002 Question #6: Real Exam Question with Answer & Explanation
The correct answer is D: When you need to group based on start and end constraints.. The transaction command is used to group events into transactions based on some common characteristics, such as fields, time, or both. The transaction command can also specify start and end constraints for the transactions, such as a field value that indicates the beginning or th
Question
When should you use the transaction command instead of the scats command?
Options
- AWhen you need to group on multiple values.
- BWhen duration is irrelevant in search results. .
- CWhen you have over 1000 events in a transaction.
- DWhen you need to group based on start and end constraints.
Explanation
The transaction command is used to group events into transactions based on some common characteristics, such as fields, time, or both. The transaction command can also specify start and end constraints for the transactions, such as a field value that indicates the beginning or the end of a transaction. The stats command is used to calculate summary statistics on the events, such as count, sum, average, etc. The stats command cannot group events based on start and end constraints, but only on fields or time buckets. Therefore, the transaction command should be used instead of the stats command when you need to group events based on start and end
Topics
Community Discussion
No community discussion yet for this question.