SPLK-1002 Practice Test 20 — 15 Questions

Question 1

Which TWO of the following are valid reasons to use transaction instead of stats for event correlation?

Accepted Answer

When you need to preserve the full events for each group.. Options A and C are correct. The transaction command is used when you need to preserve the full events for each group (A), which stats does not do (it produces statistical results). Additionally, transaction allows you to enforce a time window between events, such as maxspan or maxpause (C). Option B is false because stats is more efficient for very large datasets; transaction can be resource-intensive. Option D is false because stats typically provides faster performance due to lower overhead. Option E is false because both commands can handle events from multiple sourcetypes; that is not a distinguishing factor.

Answer

When working with very large datasets.

Answer

When you need faster search performance.

Answer

When events come from different sourcetypes.

Question 2

A search uses `transaction sessionId` to correlate events. However, the transaction command is consuming too much memory and the search fails. Which approach can reduce memory usage while still approximating the transaction grouping?

Accepted Answer

Use `stats values(_raw) by sessionId`. Using `stats values(_raw) by sessionId` aggregates raw events into a multivalue field, which is more memory-efficient than transaction because it does not try to compute duration or keep all event metadata.

Answer

Add `maxevents=100` to the transaction

Answer

Use `dedup sessionId`

Answer

Increase the search job memory limit

Question 3

Which three conditions can cause a transaction to close prematurely? (Choose three.)

Accepted Answer

The maxevents value is reached.. Options A, C, and D are correct. The maxevents (A), maxpause (C), and maxspan (D) settings all cause a transaction to close when their respective limits are reached, potentially before all related events are grouped, which constitutes premature closure. Option B (startswith again) does not close the current transaction; it starts a new transaction, but the previous one may close due to other limits. Option E (endswith) closes the transaction by design when the endswith event is detected, so it is not considered premature.

Answer

The startswith event is encountered again.

Answer

The endswith event is detected.

Question 4

An analyst uses transaction to group web requests by session_id. Some transactions are unexpectedly large, containing hundreds of events. What parameter should be adjusted to limit the number of events per transaction?

Accepted Answer

maxevents. Maxevents limits the number of events in a transaction. Option A (maxspan) limits the maximum time span of the transaction. Option B (maxpause) limits the maximum pause between events. Option C (mvcount) is used to count multivalue fields, not to limit event count.

Answer

maxspan

Answer

maxpause

Answer

mvcount

Question 5

Which TWO options are valid parameters of the `transaction` command?

Accepted Answer

maxpause. Correct options: B (maxpause) and D (keepevicted). Option A (timeformat) is for time parsing, not transaction. Option C (sequential) is not a valid parameter of the `transaction` command. Option E (fieldlist) is not a parameter; fields are given as arguments.

Answer

timeformat

Answer

sequential

Answer

fieldlist

Question 6

A Splunk search uses 'transaction clientip maxpause=5m'. What does the maxpause setting control?

Accepted Answer

The maximum time gap between events in the transaction.. maxpause sets the maximum inactivity timeout: if no new event for the same clientip arrives within 5 minutes, the transaction is closed.

Answer

The maximum number of transactions allowed.

Answer

The maximum number of events in the transaction.

Answer

The maximum total time span of the transaction.

Question 7

A Splunk admin notices that a transaction search using the transaction command takes a long time and consumes high memory. The search correlates events by a high-cardinality field (IP address) across multiple indexers. Which optimization technique should be applied first?

Accepted Answer

Increase maxevents to capture more events per transaction.. The correct optimization technique is to increase maxevents, which allows the transaction command to capture more events per transaction, reducing the number of incomplete transactions and improving performance. The fields command reduces data but does not directly address transaction boundaries. The keepevicted option retains incomplete transactions without optimizing performance. The local parameter limits parallelism, increasing time and memory usage on a single indexer.

Answer

Use the fields command to remove unnecessary fields before the transaction.

Answer

Use the keepevicted option to retain incomplete transactions.

Answer

Use the local parameter to force local processing.

Question 8

Which TWO conditions can cause a transaction to be evicted?

Accepted Answer

Maximum pause between events exceeded. Correct options: A (Maximum pause between events exceeded) and C (Maximum number of events per transaction reached). These are two conditions that cause a transaction to be evicted. Option B (Timestamp format mismatch) does not cause eviction; it may cause events not to be grouped. Option D (Transaction has too many fields) is not a standard eviction condition. Option E (Search is canceled by user) stops the search, not evicts a transaction.

Answer

Timestamp format mismatch

Answer

Transaction has too many fields

Answer

Search is canceled by user

Question 9

An analyst wants to ensure that a transaction is only considered complete when it contains a specific end event. Which transaction parameter should be used?

Accepted Answer

endswith. The endswith parameter specifies the event that marks the end of a transaction. Option A (startswith) defines the start event. Option C (maxpause) sets the maximum idle time between events. Option D (maxspan) sets the maximum total duration of the transaction.

Answer

startswith

Answer

maxpause

Answer

maxspan

Question 10

An analyst runs the following search to correlate login and logout events: `index=auth | transaction user startswith="LOGIN" endswith="LOGOUT"`. However, some transactions span over 24 hours. Which option should be added to limit each transaction to a maximum of 8 hours?

Accepted Answer

maxspan=8h. Maxspan=8h limits the total time window of the transaction to 8 hours. Option A (maxevents) limits the number of events, not time. Option B (duration) is not a valid transaction option. Option C (maxpause) limits inactivity between events, not the total span.

Answer

maxevents=10

Answer

duration=8h

Answer

maxpause=8h

Question 11

Which TWO fields are automatically created by the transaction command? (Select exactly 2 correct answers.)

Accepted Answer

_endtime. The transaction command adds _starttime and _endtime fields to each event in the transaction. It also adds duration and eventcount, but those are not listed as options. _time and maxpause are not created by transaction.

Answer

total_events

Answer

_time

Answer

maxpause

Question 12

An analyst wants to correlate events from multiple sourcetypes that have different timestamps but share a common reference ID. The events are ingested with some delay. Which parameter is crucial to ensure the transaction captures all related events despite ingestion delay?

Accepted Answer

maxspan. A large maxspan accommodates delays in event arrival. Option A (maxpause) would not capture events if there is a large gap. Option B (maxevents) does not affect time. Option C (fields _indextime) is irrelevant.

Answer

maxpause

Answer

maxevents

Answer

fields _indextime

Question 13

Which transaction option should be used to ensure that a transaction does not exceed a total duration of 10 minutes?

Accepted Answer

maxspan=10m. The correct option is D (maxspan=10m) because maxspan sets the maximum total duration of a transaction from start to end. Option A (endswith) defines the ending event, not duration. Option B (maxpause) limits the maximum pause between events within a transaction. Option C (startswith) defines the starting event. Therefore, maxspan is used to ensure the entire transaction does not exceed 10 minutes.

Answer

endswith="end"

Answer

maxpause=10m

Answer

startswith="start"

Question 14

A security analyst wants to group all events from a single web session into one transaction. The session is identified by a 'sessionId' field, and events are generated over a period that can last up to 30 minutes. The analyst also wants to close the transaction if there is no activity for more than 10 minutes. Which transaction parameters should be used?

Accepted Answer

maxspan=30m, maxpause=10m. The maxspan parameter sets the maximum total duration of the transaction, while maxpause sets the inactivity timeout. Option D correctly specifies maxspan=30m (to cover the maximum session length) and maxpause=10m (to close the transaction after 10 minutes of inactivity).

Answer

maxspan=30m, maxpause=5m

Answer

maxspan=10m, maxpause=30m

Answer

maxspan=1h, maxpause=10m

Question 15

Which THREE of the following are valid ways to correlate events in Splunk? (Select exactly 3 correct answers.)

Accepted Answer

Using the join command with a common field.. Transaction groups events based on common fields. Join can correlate events from two searches. Stats with values can also correlate by grouping events into a single result. Append and subsearch do not perform correlation.

Answer

Using the subsearch command.

Answer

Using the append command.