Splunk Core Certified Power User — Question 98

What is the correct syntax for the transaction command?

Answer options

• A. | transaction(clientip,5m,1m)
• B. | transaction clientip maxspan=5 pause=1
• C. | transaction clientip maxspan=5m maxpause=1m
• D. | transaction(clientip, 5, 1)

Correct answer: C

Explanation

Option C is correct because it uses the proper syntax for the transaction command, specifying both maxspan and maxpause with the correct units. Option A incorrectly uses parentheses, and Option D lacks the necessary units for the parameters. Option B does not specify maxpause with the correct syntax either.