Exam SPLK-1002 topic 1 question 96 discussion

A, B, D

It's B,D

Answer ABD reference link https://docs.splunk.com/Documentation/Splunk/8.1.1/SearchReference/Transaction

A,B,D The transaction command creates a single event from a group of events – The events must share the same value in a specified field

answer = ABD

B&D - the context for the search is correct. This is an example directly from Splunk: "transaction host cookie maxspan=30s maxpause=5s"

The correct answer is D. The maxspan option specifies that the first and last events in a transaction can be no more than 30 seconds apart. The maxpause option specifies that if there is a pause between events longer than 5 seconds, a new transaction will be started. Therefore, option D is correct as it describes the maximum time duration allowed for a transaction to occur between its first and last events. Options A and C are incorrect because they refer to a different parameter not mentioned in the Splunk search command. Option B is partially correct, as it describes the fields used to group events together, but it does not describe the time constraints on the transaction itself.

answer is BD - Define a transaction based on Web access events that share the same IP address. The first and last events in the transaction should be no more than thirty seconds apart and each event should not be longer than five seconds apart. https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Transaction#transaction

A is wrong: the maxspan defines the maximum pause between 2 consecutive events

Example is here: https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/Transaction Define a transaction based on Web access events that have a unique combination of host and clientip values. The first and last events in the transaction should be no more than thirty seconds apart and each event should not be longer than five seconds apart. So it would group events in a transaction where IP=1.2.3.4 and hostwww1. IP=1.2.3.4 and host=www2 would be in another transacton (B) A is a trick question or badly formulated. Pause between events within the transactions should be no more than 5s apart. However, the total transaction time can be much longer.

B,D are correct. Here is the description of the maxpause command Specifies the maximum length of time in seconds, minutes, hours, or days for the pause between the events in a transaction. If value is negative, the maxpause constraint is disabled and there is no limit. A would only be definitively correct if the transaction had 2 events. If it has more than 2 events then the time between the first and last event are unknown, all we know is no 2 events are more than 5 seconds apart.

A,B, D

It's B,D

I'ts A B D. Go to study.