Courseiva

SPLK-1002

Study mode — explanations shown

1

Transactions and Event Correlation

hard

A search using the transaction command is producing many partial transactions that are closed due to maxpause, but these transactions are often relevant and should not be discarded. Which option should be added to the transaction command to keep these partial results?

0 of 180 answered