Determine When to Use Transactions vs. Stats SPLK-1002 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Why is stats often preferred over transaction for simple aggregations?

   • AStats can combine multiple events into a single event with all original fields
   • BStats is simpler to use and provides faster results for field-based aggregations
   • CStats can automatically detect the start and end of a transaction
   • DStats can group events by time ranges without specifying fields
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is a known limitation of the transaction command?

   • AIt only works with events that have a timestamp
   • BIt cannot group events based on a common field
   • CIt cannot be used with the search command
   • DIt can consume significant memory and processing resources when grouping many events
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is a limitation of the transaction command related to event ordering?

   • AIt cannot handle events from multiple sources
   • BIt cannot be used with time-based options like maxspan
   • CIt requires events to have a specific field named 'transaction_id'
   • DEvents must be in chronological order for the transaction to be correctly formed
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A support team wants to analyze a customer's entire support session, which consists of multiple events (login, chat messages, ticket creation, logout) that occur over a period of up to 30 minutes. The events share a common session_id field. The team needs to see the full sequence of events for each session to understand the flow. Which command should be used?

   • Atransaction session_id maxspan=30m
   • Btransaction maxspan=30m
   • Cstats count by session_id
   • Dstats values(_raw) by session_id
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A financial analyst needs to calculate the total transaction amount and the number of transactions per customer from a dataset of financial events. Each event has fields: customer_id, amount, and transaction_id. The analyst does not need to see the individual events. Which command should be used?

   • Atransaction transaction_id, then use eventstats to calculate totals
   • Btransaction customer_id, then use stats to calculate totals
   • Cstats sum(amount) AS total_amount, count(transaction_id) AS num_transactions by customer_id
   • Dstats values(amount) AS total_amount, count(transaction_id) AS num_transactions by customer_id
   Reveal Solution Discussion Select an answer first