In most large Splunk environments, what is the most efficient command that can be used to group events by fields/

In most large Splunk environments, what is the most efficient command that can be used to group events by fields/
A . join
B . stats
C . streamstats
D . transaction

View Answer

Answer: B

Explanation:

https://docs.splunk.com/Documentation/Splunk/8.0.2/Search/Abouttransactions

In other cases, it’s usually better to use the stats command, which performs more efficiently, especially in a distributed environment. Often there is a unique ID in the events and stats can be used.