The analyst only needs each user's first civic VPN time and last file-share access, not a full multi-event session. Why is stats first() last() better than transaction?

In Splunk Enterprise Security for a municipal SOC, Splunk guidance prefers stats over transaction when the investigation only needs grouped aggregates rather than a retained multi-event session. If the analyst only needs each user’s first civic VPN time and last file-share access, stats first() and last() return those endpoints without the memory cost of building full transaction collections. Claiming transaction cannot see the user field, so stats is the only command that groups, fails by concept because transaction can group by user; the issue is cost and necessity, not field visibility. Claiming stats writes notables automatically, which transaction cannot do, fails by concept because neither command creates notables by itself—adaptive responses and ES content do. Claiming first() and last() only work after a SOAR playbook materializes the events fails by concept because those functions operate on search results directly without SOAR. Exam caveat: SPLK-5001 expects analysts to choose stats first()/last() for efficient civic endpoint aggregates and reserve transaction for when the full session body is required. Operational check: run stats earliest/first and latest/last VPN and file-share times by user for the hunt window, spot-check a user against a bounded transaction, confirm the endpoints answer the question without full sessions, and document why transaction was not needed for this municipal case.