Which of these is NOT a field that is automatically created with the transaction command?

The correct answer is A. maxcount. The transaction command automatically creates 'duration' and 'eventcount' fields, but 'maxcount' is a parameter used when calling the command, not a field it creates.

Correlating Events

Question

Options

Amaxcount
Bduration
Ceventcount

How the community answered

(58 responses)

A
86% (50)
B
9% (5)
C
5% (3)

Why each option

The transaction command automatically creates 'duration' and 'eventcount' fields, but 'maxcount' is a parameter used when calling the command, not a field it creates.

AmaxcountCorrect

maxcount is a parameter you supply to the transaction command to limit the number of events per transaction; it is not a field automatically added to the resulting transaction events.

Bduration

duration is automatically created by the transaction command and represents the time difference in seconds between the first and last event in each transaction.

Ceventcount

eventcount is automatically created by the transaction command and stores the total number of raw events that were grouped into each transaction.

Concept tested: Splunk transaction command auto-generated fields

Source: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

Topics

#Splunk commands#transaction command#Automatic fields#SPL

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice