Why would the transaction command be used instead of the stats command?
A.
The transaction command is less resource-intensive.
B.
The transaction command can perform calculations on fields.
C.
The transaction command keeps the raw data for each event.
D.
The transaction command has better search-time performance.
The Answer Is:
C
This question includes an explanation.
Explanation:
The transaction command retains the raw events grouped together, preserving all details of each event within the transaction. In contrast, the stats command aggregates data and often discards raw event data, which is not suitable when full event context is needed.
[Reference:, Splunk Power User Study Guide, Search Commands, Splunk Docs: transaction vs stats, "transaction keeps raw event data intact for grouped events, unlike stats which aggregates and summarizes.", , , ]
SPLK-1002 PDF/Engine
Printable Format
Value of Money
100% Pass Assurance
Verified Answers
Researched by Industry Experts
Based on Real Exams Scenarios
100% Real Questions
Get 65% Discount on All Products,
Use Coupon: "ac4s65"