Splunk Core Certified Power User — Question 162

Why would the transaction command be used instead of the stats command?

Answer options

• A. The transaction command can perform calculations on fields.
• B. The transaction command has better search-time performance.
• C. The transaction command keeps the raw data for each event.
• D. The transaction command is less resource-intensive.

Correct answer: C

Explanation

The correct answer is C because the transaction command is designed to maintain the raw data of each event, allowing for in-depth analysis. Options A, B, and D are incorrect as they do not accurately represent the primary function of the transaction command in retaining raw event data.