When using the transaction command, how are evicted transactions identified?
When using the transaction command, how are evicted transactions identified?
Evicted transactions are identified by the 'closed_txn' field being set to 0, or false. This indicates that the transaction did not close properly and was evicted.
D is correct, https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Transaction
"keepevicted Syntax: keepevicted=<bool> Description: Whether to output evicted transactions. Evicted transactions can be distinguished from non-evicted transactions by checking the value of the 'closed_txn' field. The 'closed_txn' field is set to '0', or false, for evicted transactions and '1', or true for non-evicted, or closed, transactions. The 'closed_txn' field is set to '1' if one of the following conditions is met: maxevents, maxpause, maxspan, startswith." from the Docu
How answer is B ? examtopics team please explain.
the ans is D
Ans is D
Answer is D