MENU
Why is the transaction command slow in large Splunk deployments?
Suggested Answer: C
Get Premium SPLK-1004 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
The transaction command can be slow in large deployments because it requires all event data relevant to the transaction to be returned to the search head, which can be resource-intensive.
12 comments · newest first
BU
Buddy
3 days ago
Wait, it runs a hidden eval? That's surprising!
LA
Laurel
8 days ago
I disagree, I think B is more impactful since it runs on all indexers.
KE
Kenneth
13 days ago
C is definitely a big reason, all that data can slow things down.
JU
Julio
18 days ago
D seems a bit off, hidden evals shouldn't slow it down that much, right?
MA
Martina
23 days ago
A is misleading, fast mode isn't the problem here.
CL
Clarinda
29 days ago
Wait, I didn't know it runs on each indexer! That sounds slow.
MA
Margot
1 month ago
I think B is the main issue, too many indexers working at once.
CA
Catarina
1 month ago
C is definitely a big factor, all that data adds up.
JE
Jennie
1 month ago
I definitely remember that fast mode is supposed to speed things up, but I’m not clear on how that relates to the transaction command's performance in large deployments.
AU
Audrie
2 months ago
I feel like the hidden eval part could be a factor too, but I can't recall if that's specifically mentioned in the context of performance issues.
JA
Jaclyn
2 months ago
I think I saw a practice question about how the transaction command returns all event data to the search head, which might be why it's slow.
IR
Iraida
2 months ago
I remember discussing how the transaction command can be resource-intensive, but I'm not sure if it's because it runs on each indexer or something else.