To Identify All of the Contributing Events Within a Transaction

Multiple Choice

To identify all of the contributing events within a transaction that contain at least one REJECT event, which syntax is correct?

A) index=main REJECT | transaction sessionid
B) index=main | transaction sessionid | search REJECT
C) index=main | transaction sessionid | where transaction=reject
D) index=main | transaction sessionid | where transaction="REJECT*"