Splunk Exam SPLK-1002 Topic 9 Question 86 Discussion

Actual exam question for Splunk's SPLK-1002 exam

Question #: 86
Topic #: 9

[All SPLK-1002 Questions]

Consider the following search:

index=web sourcetype=access_combined

The log shows several events that share the same JSESSIONID value (SD470K92802F117). View the events as a group.

From the following list, which search groups events by JSESSIONID?

Aindex=web sourcetype=access_combined | highlight JSESSIONID | search SD470K92802F117

Bindex=web sourcetype=access_combined | transaction JSESSIONID | search SD470K92802F117

Cindex=web sourcetype=access_combined SD470K92802F117 | table JSESSIONID

Dindex=web sourcetype=access_combined JSESSIONID <SD470K92802F117>

Show Suggested Answer

Suggested Answer: B

To group events by JSESSIONID, the correct search is index=web sourcetype=access_combined | transaction JSESSIONID | search SD470K92802F117 (Option B). The transaction command groups events that share the same JSESSIONID value, allowing for the analysis of all events associated with a specific session as a single transaction. The subsequent search for SD470K92802F117 filters these grouped transactions to include only those related to the specified session ID.

by Shalon at May 02, 2024, 07:12 AM

Limited Time Offer

25%

7 months ago

This exam question is tricky.

upvoted 0 times

...