Correlating Events

Question 1

What does the |transaction command do?

Answer 1

The |transaction command allows you to group events together based on one or more fields

Question 2

What fields does the |transaction command add to events?

Answer 2

• duration
• eventcount

Question 3

What is the syntax for the |transaction command?

Answer 3

|transaction (<field>|<fields>) [options]</fields></field>

Question 4

What options are available for the |transaction command?

Answer 4

• maxspan
• maxpause
• maxevents
• startswith
• endswith

Question 5

If a transaction has more than five events, what is present?

Answer 5

A show all # lines option showing the rest of the events.

Question 6

True or False: Fields within each transaction can have multiple values

Answer 6

True

Transactions are pulling multiple events, aka multivalued fields.

Question 7

What does the maxspan option do?

Answer 7

Controls the maximum total time between the earliest and latest events. Defaults to -1 (no max time limit)

Question 8

What does the maxpause option do?

Answer 8

Controls the maximum total time between events. Defaults to -1 (no max time pause limit)

Question 9

True or False: you can pipe to transforming commands after the transaction command

Answer 9

True.

You can use stats and transforming commands with transactions to create reports and visualizations.

Question 10

True or False: The transaction command can contain the eval function.

Answer 10

True.

Question 11

Transactions are assigned either a 0 or 1 in the closed_txn field. What do these indicate?

Answer 11

1 - Conditions are met and the transaction is complete.

0 - Conditions are not met and the transaction is incomplete.

Question 12

What does the keepevicted option of the |transaction command do?

Answer 12

keepevicted takes a value of true or false, and is set to 0 by default, evicting all complete transactions. Setting keepevicted to a value of 1, will show incomplete transactions.

Question 13

Since the transaction command is resource intensive, you should ______.

Answer 13

use the stats command whenever possible.

Question 14

When is the transaction command a better choice over the stats command?

Answer 14

When events need to be seen correlated together and displayed in the raw event view.

When you need to define event grouping on start/end values or segment on time.

Question 15

How is stats different from transactions?

Answer 15

• Faster and more efficient
• Can perform calculations
• Can group events based on a single field value (e.g. “by src_ip”)

Question 16

What happens when the transaction command reaches 1,000 events per transaction?

Answer 16

A new transaction grouping will be created.

Question 17

Does stats have a limit?

Answer 17

No.