Determine When to Use Transactions vs. Stats SPLK-1002 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is a valid use of the transaction command?

   • Atransaction count BY session_id
   • Btransaction max=session_id
   • Ctransaction session_id startswith="login" endswith="logout"
   • Dtransaction session_id=12345
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of the stats command in Splunk?

   • ATo join events from two different data sources based on a common field
   • BTo sort events by a specified field in ascending or descending order
   • CTo aggregate events based on common fields and compute statistical values
   • DTo group related events into a single transaction for end-to-end analysis
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the basic syntax of the transaction command?

   • Atransaction <regex>
   • Btransaction <field1> <field2> ...
   • Ctransaction <field>=<value>
   • Dtransaction <function> BY <field>
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the basic syntax of the stats command?

   • Astats <field>=<value>
   • Bstats <regex>
   • Cstats <aggregation function> BY <field>
   • Dstats <field> <field2>
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which scenario is best suited for the stats command rather than the transaction command?

   • ACalculating the total number of bytes transferred per user from firewall logs
   • BCombining login, search, and logout events into a single session for analysis
   • CJoining events from two different data sources based on a common field
   • DGrouping all events from a single purchase flow into one transaction to measure its duration
   Reveal Solution Discussion Select an answer first