https://docs.splunk.com/Documentation/DashApp/0.9.0/DashApp/chartsBub

https://docs.splunk.com/Documentation/Splunk/8.0.2/Search/Abouttransactions
In other cases, it's usually better to use the stats command, which performs more efficiently, especially in a
distributed environment. Often there is a unique ID in the events and stats can be used.

Splunk alerts can be based on searches that run in real-time or on a regular schedule3. An alert is a way to
monitor your data and get notified when certain conditions are met3. You can create an alert by specifying a
search and a triggering condition3. You can also specify how often you want to run thesearch and how you
want to receive the alert notifications3. You can run the alert search in real-time, which means that it
continuously monitors your data as it streams into Splunk3. Alternatively, you can run the alert search on a
regular schedule, which means that it runs at fixed intervals such as everyhour or every day3. Therefore,
options A and B are correct, while option C is incorrect because it is not a way to run an alert search.

This is because event types are added to events as a field named eventtype, and you can use this field as a search term to find events that match a specific event type. For example, eventtype=successful_purchases returns all events that have been categorized as successful purchases by the event type definition. The other options are incorrect because they either use a different field name (tag), a different syntax (Event Type:: or event type-), or have a typo (success ful_purchases). You can learn more about how to use event types in searches from the Splunk documentation1.