Splunk Infrastructure Overview — Question 59

What order of incoming events must be supplied to the transaction command to ensure correct results?

Answer options

• A. Reverse lexicographical order
• B. Ascending lexicographical order
• C. Ascending chronological order
• D. Reverse chronological order

Correct answer: D

Explanation

The correct answer is D, Reverse chronological order, because the transaction command processes events from the most recent to the oldest to maintain data integrity. The other options do not ensure that the latest events are handled first, which could lead to incorrect results.