Explanation
The correct answer is B, because the tstats command can be used to perform statistical queries on indexed fields in TSIDX files. TSIDX files are files that store the index data for Splunk, such as the events, timestamps, and fields. Indexed fields are fields that are extracted and stored in the TSIDX files at index time, which makes them faster to search than non-indexed fields. The tstats command is a search command that performs statistical calculations on indexed fields, such as count, sum, avg, and so on. The tstats command is faster than the stats command, which performs statistical calculations on any fields, because it does not need to retrieve the events from the index, but only the fields from the TSIDX files. The other options are not search commands that can be used to perform statistical queries on indexed fields in TSIDX files. The stats command performs statistical calculations on any fields, not just indexed fields. The tscollect command collects the results of a transforming search and writes them to a TSIDX file. The transaction command groups events into transactions based on common values.