Why is the transaction command slow in large splunk deployments?

Why is the transaction command slow in large splunk deployments?
A . It forces the search to run in fast mode.
B . transaction or runs on each Indexer in parallel.
C . It forces all event data to be returned to the search head.
D . transaction runs a hidden eval to format fields.

View Answer

Answer: C

Explanation:

The transaction command can be slow in large Splunk deployments because it requires all event data relevant to the transaction to be returned to the search head (Option C). This process can be resource-intensive, especially for transactions that span a large volume of data or time, as it involves aggregating and sorting events across potentially many indexers before the transaction logic can be applied.