The analyst only needs each user's first civic VPN time and last file-share access, not a full multi-event session. Why is stats first() last() better than transaction?
Select an answer to reveal the explanation.
Short Explanation
If only the first and last subway stops matter, there is no need to rebuild the whole train. transaction keeps every car in memory; stats first() last() just grabs the ends. Use the light tool when grouping is enough.
Full Explanation
Splunk guidance prefers stats over transaction when the investigation only needs grouped aggregates. transaction retains event collections and is memory-intensive. stats first() and last() return the endpoint values per user without that cost. The command choice is about efficiency and completeness of the civic question, not about notables or SOAR.