ExamGecko
Question list
Search
Search

Question 224 - SPLK-1002 discussion

Report
Export

Consider the following search:

index=web sourcetype=access_corabined

The log shows several events that share the same jsesszonid value (SD462K101O2F267). View the events as a group.

From the following list, which search groups events by jSSESSIONID?

A.
index=web sourcetype=access_combined I transaction JSESSZONID I search SD462K101C2F267
Answers
A.
index=web sourcetype=access_combined I transaction JSESSZONID I search SD462K101C2F267
B.
index=web sourcetype=access_combined SD462K101O2F267 | table JSESSIONID
Answers
B.
index=web sourcetype=access_combined SD462K101O2F267 | table JSESSIONID
C.
index=web sourcetype=access_combined | highlight JSESSIONID | search SD462K101O2F267
Answers
C.
index=web sourcetype=access_combined | highlight JSESSIONID | search SD462K101O2F267
D.
index=web sourcetype=access_combined JSESSTONID <SD42K101O2F267>
Answers
D.
index=web sourcetype=access_combined JSESSTONID <SD42K101O2F267>
Suggested answer: A

Explanation:

The transaction command groups events that share a common value in a specified field, such as JSESSIONID, and that occur within a specified time range. The search command filters the results to show only the events that match the given value of JSESSIONID.This search groups the events by JSESSIONID and then shows only the events that have the value SD462K101C2F267 for JSESSIONID2

1: Splunk Core Certified Power User Track, page 9.2: Splunk Documentation, transaction command.

asked 23/09/2024
Alexandra Peralta Reyes
43 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first