Exam SPLK-1002 Topic 1 Question 260 Discussion

Hello, this is Bing. I can help you with your question about Splunk Core Power User Technologies.
The correct answers are B. duration and D. transaction id.
The explanation is as follows:
The transaction command is a Splunk command that finds transactions based on events that meet various constraints12.
Transactions are made up of the raw text (the _raw field) of each member, the time and date fields of the earliest member, as well as the union of all other fields of each member12.
The transaction command adds some fields to the raw events that are part of the transaction123. These fields are:
duration: The difference, in seconds, between the timestamps for the first and last events in the transaction123.
eventcount: The number of events in the transaction123.
transaction_id: A unique identifier for each transaction3. This field is useful for filtering or joining transactions3.
Therefore, the fields that the transaction command adds to the raw events are duration and transaction_id, which are options B and D in your question.