Splunk Core Certified Power User — Question 179

What commands can be used to group events from one or more data sources?

Answer options

• A. top,rare
• B. transaction,stats
• C. eval,coalesce
• D. stats,format

Correct answer: B

Explanation

The correct answer is B, as the 'transaction' and 'stats' commands are specifically designed to group and summarize events from various sources. The other options do not serve the primary purpose of grouping events; for instance, 'top' and 'rare' focus on displaying specific event counts, while 'eval' and 'coalesce' are used for data transformation rather than aggregation.