Why is the transaction command slow in large splunk deployments?

The correct answer is C. It forces all event data to be returned to the search head. The transaction command can be slow in large Splunk deployments because it requires all event data relevant to the transaction to be returned to the search head (Option C). This process can be resource-intensive, especially for transactions that span a large volume of data or…

Optimizing Search Performance

Question

Options

AIt forces the search to run in fast mode.
Btransaction or runs on each Indexer in parallel.
CIt forces all event data to be returned to the search head.
Dtransaction runs a hidden eval to format fields.

How the community answered

(32 responses)

A
3% (1)
B
3% (1)
C
94% (30)

Explanation

The transaction command can be slow in large Splunk deployments because it requires all event data relevant to the transaction to be returned to the search head (Option C). This process can be resource-intensive, especially for transactions that span a large volume of data or time, as it involves aggregating and sorting events across potentially many indexers before the transaction logic can be applied.

Topics

#transaction command#search performance#search head#event grouping

Community Discussion

No community discussion yet for this question.

Full SPLK-1004 Practice