Objective 3.6
Core Certified Power UserDetermine when to use transactions vs. stats
Objective 3.6 sits in Correlating Events, which carries 15% of the Core Certified Power User exam. The questions below are original, written from the official objective title above, and each explanation cites the Splunk page it rests on.
Objective title verbatim from the official objectives. Splunk exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
A team asks how the stats and transaction commands differ in what they keep. What does Splunk say stats does with the events?
Correct.
Checked against help.splunk.com, August 2026Concept
One command answers with numbers and throws away the evidence, the other keeps the evidence and computes almost nothing. Choosing between them is really choosing what you need to read afterwards.
Why A
Splunk states that the stats command is meant to calculate statistics on events grouped by one or more fields and discard the events, while the transaction command retains the raw event and other field values from the original event.
Source
Splunk Docs: About transactions, checked August 2026The stats command is meant to calculate statistics on events grouped by one or more fields and discard the events (unless you are using eventstats or streamstats ). On the other hand, except for the duration between first and last events and the count of events, the transaction command does not compute statistics over the grouped events.
Now you: objective 3.6 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 2
An engineer has a unique ID on every event and wants the cheapest grouping. What does Splunk recommend?
Sample question 2 of 2
A web team identifies sessions by a cookie that gets reused across visits. Which command does Splunk say suits that case?
Full Core Certified Power User question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.