Consider the following search:
index=web sourcetype=access_combined
The log shows several events that share the same JSESSIONID value (SD421K26502F783). View the events as a group.
From the following list, which search groups events by JSESSIONID?
Consider the following search:
index=web sourcetype=access_combined
The log shows several events that share the same JSESSIONID value (SD421K26502F783). View the events as a group.
From the following list, which search groups events by JSESSIONID?
To group events by JSESSIONID, the correct approach involves using the transaction command, which groups events that share the same field value. The correct search syntax is index=web sourcetype=access_combined | transaction JSESSIONID. This search will group all the events that share the same JSESSIONID value into a single transaction event. While there appears to be a typo in the provided option (index-web instead of index=web), the fundamental logic of using the transaction command aligns with the search requirement. Therefore, this option is correct based on its intent and functionality.
I think the answer is A. It is the only option that groups the events.
It can't be A as index-web is a wrong syntax
concern about a is that there is a hyphen between index and web instead of equal sign
All of them do not fulfill the request to group - A and B have wrong index syntax, C will just list a table with a single JSESSIONID which leaves D as the closest to an answer. If it was index= in A it would have been the correct answer
the answer is D , i tried them all , D is the only one that works
This is Def A - The Transaction command groups events
index-web this could be a typo not sure
It's definitely A. I think this question has a typo and the question was really supposed to start with index=web rather than index-web. No other answers fit.
The 2 first have a typo, index-web should be index=web. In the real exam it is written correctly, so the correct answer is then A - using the | transaction JSESSIONID
index=wed, not -A
The answer is D.
A is the correct ans. D is giving error
"View the events as a group" = transaction
A is correct "View the events as a group" = transaction
Answer A typo error index=web is correct.
Answer should be D, I tried both A and D but since A index-web which is wrong
only correct answers SPL don't find index- , got = it not miss typo is buggy question