Splunk Core Certified Power User — Question 58

Which of the following statements would help a user choose between the transaction and stats commands?

Answer options

• A. stats can only group events using IP addresses.
• B. The transaction command is faster and more efficient.
• C. There is a 1000 event limitation with the transaction command.
• D. Use stats when the events need to be viewed as a single correlated event.

Correct answer: C

Explanation

The correct answer, C, is accurate because the transaction command does have a limitation of 1000 events that can be processed at once. Option A is incorrect since stats can group by various fields, not solely IP addresses. Option B is misleading as transaction can be slower due to its processing requirements, and option D is incorrect because it describes the purpose of stats but does not address limitations relevant to the choice between the two commands.