Search with Transactions SPLK-1002 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A web analytics team uses the transaction command to group page views into user sessions. They want to calculate the average session duration and the average number of pages per session. Which fields generated by the transaction command should they use in their stats command?

   • A_time and _raw
   • Bstart and end
   • Cduration and eventcount
   • Dcount and total
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following best describes how the transaction command works?

   • AIt merges events that have the same timestamp into a single event
   • BIt groups events into a single event when they share common field values and occur within a specified time range
   • CIt creates a new event that contains all the fields and values from the first event in the group
   • DIt splits a single event into multiple events based on field values
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An analyst needs to correlate events from a login process and calculate the total number of events per session. They are considering using transaction or stats with eventstats. Which statement correctly describes a trade-off between the two approaches?

   • Astats with eventstats is always faster than transaction.
   • Btransaction can only be used with a single field, while stats can use multiple fields.
   • Cstats with eventstats preserves the original events, while transaction does not.
   • Dtransaction provides a duration field, while stats with eventstats does not.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A DevOps team is troubleshooting a microservices architecture. They use the transaction command to group logs from a single request across multiple services. They notice that some transactions are incomplete because the default maxevents limit is too low. They want to increase the limit to 500 events per transaction. Which option should they use?

   • Amaxpause=500
   • Bmaxevents=500
   • Cmaxspan=500
   • Dkeepevicted=true
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A large enterprise has a high-volume log stream. They need to correlate events from a multi-step process, but they are concerned about the performance impact of the transaction command. They want to achieve similar grouping functionality with better performance. Which approach should they consider?

   • AUse stats with eventstats to group events by a common field and calculate aggregate values.
   • BUse transaction with a larger maxspan to reduce the number of transactions.
   • CUse transaction with keepevicted=false to improve performance.
   • DUse transaction with maxevents=1 to reduce the number of events per transaction.
   Reveal Solution Discussion Select an answer first