To identify all of the contributing events within a transaction that contains at least one REJECT event, which syntax is correct?

exams SPLK-1002 SPLK-1002 exam 0 Comments

To identify all of the contributing events within a transaction that contains at least one REJECT event, which syntax is correct?
A . Index-main | REJECT trans sessionid
B . Index-main | transaction sessionid | search REJECT
C . Index=main | transaction sessionid | whose transaction=reject
D . Index=main | transaction sessionid | where transaction=reject’’

Answer: B