Splunk Core Certified Power User Exam SPLK-1002 Question # 72 Topic 8 Discussion

SPLK-1002 Exam Topic 8 Question 72 Discussion:

Question #: 72

Topic #: 8

To identify all of the contributing events within a transaction that contains at least one REJECT event, which syntax is correct?

Index-main | REJECT trans sessionid

Index-main | transaction sessionid | search REJECT

Index=main | transaction sessionid | whose transaction=reject

Index=main | transaction sessionid | where transaction=reject’’

Get Premium SPLK-1002 Questions

Actual exam question for Splunk SPLK-1002 exam by Arlo76778 at Oct 19, 2025, 2:33:20 AM

Chosen Answer: A B C D
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.