Splunk Core Certified Power User Exam SPLK-1002 Question # 17 Topic 2 Discussion

SPLK-1002 Exam Topic 2 Question 17 Discussion:

Question #: 17

Topic #: 2

To identify all of the contributing events within a transaction that contains at least one REJECT event, which syntax is correct?

Index-main | REJECT trans sessionid

Index-main | transaction sessionid | search REJECT

Index=main | transaction sessionid | whose transaction=reject

Index=main | transaction sessionid | where transaction=reject’’

Get Premium SPLK-1002 Questions

Actual exam question for Splunk SPLK-1002 exam by Zephyr3710 at Aug 3, 2025, 12:00:00 AM

Chosen Answer: A B C D
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.