When should you use the transaction command instead of the scats command?

Posted by: Pdfprep Category: SPLK-1002 Tags: , ,

When should you use the transaction command instead of the scats command?
A . When you need to group on multiple values.
B . When duration is irrelevant in search results. .
C . When you have over 1000 events in a transaction.
D . When you need to group based on start and end constraints.

Answer: D

Leave a Reply

Your email address will not be published.