Answer is D. The argument maxspan=1d will join events to one transaction by status per day. You would see the curve lines on graph if answer C is right, cause graph values are shown with span=12h
Correct, but your reasoning is abit off, maxspan will set the maximum point between the earliest and latest transaction, so 1D would be the maximum limit between the first/last, which is obviously not true in the graph.
I tested it and C gives similar result. what I tried :
index=web sourcetype=access_combined | fields sourcetype, status | transaction status maxspan=1d | timechart count by status
C works, tested with different sourcetype that has the same status field with skipped and success
index=_internal sourcetype=scheduler | fields sourcetype, status | transaction status maxspan=1d | timechart count by status
https://docs.splunk.com/Documentation/Splunk/9.0.2/SearchReference/Transaction
maxspan
Syntax: maxspan=<int>[s | m | h | d]
Description: Specifies the maximum length of time in seconds, minutes, hours, or days that the events can span. The events in the transaction must span less than integer specified for maxspan. Events that exceed the maxspan limit are treated as part of a separate transaction. If the value is negative, the maxspan constraint is disabled and there is no limit.
Default: -1 (no limit)
While I was on playing around with the Splunk training data (sourcetype=access_combined_wcookie), seems C produces the same type linechart graph (assuming the status field has only 2 values in the events skipped and success)..
I would go for answer D: (fields sourcetype, status are not equal to skipped and succes)
upvoted 6 times
...
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
New_user
Highly Voted 3 years, 5 months agorafiki31
2 years, 8 months agoTestingAccount900
2 years, 3 months agoparo2
Highly Voted 3 years, 7 months agoS_E_A_N
Most Recent 2 weeks, 5 days agotatdatpham
4 months agovoiddraco
3 months, 2 weeks agoAlexi2415
10 months, 2 weeks agoStevenBzh
1 year, 2 months agojsk46
1 year, 3 months agokirtak
1 year, 8 months agoHurshbabe
1 year, 3 months agoAsheel1
10 months, 2 weeks agocodemk
2 years agoSolventCourseisSCAM
1 year, 11 months agoHudda
3 years, 5 months agohellonair
3 years, 6 months agoShafiqul
3 years, 7 months agoRoGr
3 years, 8 months ago