Report on Transactions SPLK-1002 Practice Questions (Page 4)

Questions 16–19

1. 16foundation · easy

   What is a key difference between the transaction command and the stats command with values()?

   • ATransaction can only be used with time-based grouping, while stats can only group by field
   • BTransaction combines events into a single event, while stats with values() creates a table with a multivalue field
   • CTransaction is faster than stats with values()
   • DTransaction preserves the original events, while stats with values() discards them
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An analyst is comparing the output of `transaction` and `stats` for correlating events. They notice that `transaction` provides a `duration` field, but `stats` does not. They need to calculate the duration for each group. Which approach would be most efficient if they need both the duration and the ability to list all event IDs in each group?

   • AUse `transaction` and rely on the duration field, then extract event IDs.
   • BUse `stats earliest(_time) as start, latest(_time) as end, values(event_id) by group_id` and calculate duration.
   • CUse `transaction` and then use `stats values(event_id) by _time`.
   • DUse `stats list(event_id) by group_id` and then calculate duration in a separate search.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A data analyst needs to correlate events that share a common order ID and also wants to calculate the total time between the first and last event for each order. They are considering using either `transaction` or `stats` with `values()`. What is the primary advantage of using `transaction` over `stats` for this task?

   • Atransaction is faster on large datasets.
   • Btransaction requires fewer resources.
   • Ctransaction preserves the original event order.
   • Dtransaction automatically calculates the duration between the first and last event.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst wants to group all events related to a single user login session. The events have a `session_id` field. The analyst also wants to see the total duration of each session. Which command should they use?

   • Astats values(session_id) by _time
   • Btransaction session_id
   • Cstats dc(session_id) by _time
   • Dtransaction startswith="login" endswith="logout"
   Reveal Solution Discussion Select an answer first