nerdexam
Splunk

SPLK-1002 · Question #97

Which of the following statements would help a user choose between the transaction and stats commands?

The correct answer is C. There is a 1000 event limitation with the transaction command. A key practical distinction between the two commands is that 'transaction' has a default limit of 1,000 events per transaction and is generally slower and more memory-intensive. The 'stats' command is more scalable and efficient for large datasets. When events do not need to be…

Correlating Events

Question

Which of the following statements would help a user choose between the transaction and stats commands?

Options

  • Astate can only group events using IP addresses.
  • BThe transaction command is faster and more efficient.
  • CThere is a 1000 event limitation with the transaction command.
  • DUse state when the events need to be viewed as a single event.

How the community answered

(20 responses)
  • A
    5% (1)
  • B
    5% (1)
  • C
    90% (18)

Explanation

A key practical distinction between the two commands is that 'transaction' has a default limit of 1,000 events per transaction and is generally slower and more memory-intensive. The 'stats' command is more scalable and efficient for large datasets. When events do not need to be viewed as a grouped single event and performance matters, 'stats' is preferred. This limitation is a meaningful criterion for choosing between them.

Topics

#transaction command#stats command#event correlation#command limitations

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice