exam questions

Exam SPLK-1002 All Questions

View all questions & answers for the SPLK-1002 exam

Exam SPLK-1002 topic 1 question 24 discussion

Actual exam question from Splunk's SPLK-1002
Question #: 24
Topic #: 1
[All SPLK-1002 Questions]

Which of the following statements describe the command below? (Choose all that apply.) sourcetype=access_combined | transaction JSESSIONID

  • A. An additional field named maxspan is created.
  • B. An additional field named duration is created.
  • C. An additional field named eventcount is created.
  • D. Events with the same JSESSIONID will be grouped together into a single event.
Show Suggested Answer Hide Answer
Suggested Answer: BCD 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
kbisht
Highly Voted 3 years, 3 months ago
B C D is the correct ans
upvoted 17 times
...
Glat
Highly Voted 2 years, 12 months ago
BCD is the answer. See p129 of F2 PDF
upvoted 8 times
...
abderrahimpro
Most Recent 7 months ago
Selected Answer: BCD
https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference/Transaction
upvoted 1 times
...
igweifeanyi
1 year, 4 months ago
ANSWER IS BCD
upvoted 2 times
...
Lalithadevi
2 years, 8 months ago
B C D is the correct ans
upvoted 2 times
...
RyanDST
2 years, 10 months ago
The transaction command adds two fields to the raw events, duration and eventcount. | transaction [<field-list>] One or more field names. The events are grouped into transactions, based on the unique values in the fields.
upvoted 5 times
...
Sandy_1988
3 years, 1 month ago
BCD are the options
upvoted 4 times
...
sid2051
3 years, 3 months ago
BCD are correct
upvoted 4 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...