Exam SPLK-1002 All QuestionsBrowse all questions from this exam
Question 48

To identify all of the contributing events within a transaction that contain at least one REJECT event, which syntax is correct?

    Correct Answer: B

    The correct syntax to identify all of the contributing events within a transaction that contain at least one REJECT event is to first create the transactions using 'transaction sessionid' and then search for the REJECT events within those transactions. This is accomplished by the command 'index=main | transaction sessionid | search REJECT', which correctly filters out transactions containing at least one REJECT event.

Discussion
gioojardinesOption: B

Yes, the correct answer is B, because in the page 133 you have a similar example.

shervin2sOption: B

yes B is true

akkkiOption: B

Is B correct option?

bapun17Option: B

B is the correct

Trafalgar_LawOption: B

B is the correct answer

kirtakOption: A

A and B are correct actually, both return the exact same results when executed.

babusartop17Option: A

A should be the correct answer

paro2

Identify the events WITHIN a transaction. B is the correct answer.