When should transaction be used?
Only in a large distributed Splunk environment.
When calculating results from one or more fields.
When event grouping is based on start/end values.
When grouping events results in over 1000 events in each group.
Submit