SPLK-1003 Practice Test 24 — 15 Questions

Question 1

A team wants to correlate events from different sourcetypes (web, db) on a common `sessionid`. They use `transaction sessionid` across both sourcetypes. The results show that some transactions are missing events. What is the most likely cause?

Accepted Answer

Timestamps from different sourcetypes are misaligned. Option B is correct because sourcetypes may have different timestamp formats or time zones, causing events to be incorrectly sorted out of the transaction window. Option A (maxevents) would truncate but not miss events. Option C (field name) is unlikely. Option D (search time level) is not relevant.

Answer

The search is running at 'info' level instead of 'verbose'

Answer

maxevents is set too low

Answer

sessionid field has different names in each sourcetype

Question 2

A search uses `transaction sessionId` to correlate events. However, the transaction command is consuming too much memory and the search fails. Which approach can reduce memory usage while still approximating the transaction grouping?

Accepted Answer

Use `stats values(_raw) by sessionId`. Using `stats values(_raw) by sessionId` aggregates raw events into a multivalue field, which is more memory-efficient than transaction because it does not try to compute duration or keep all event metadata.

Answer

Add `maxevents=100` to the transaction

Answer

Use `dedup sessionId`

Answer

Increase the search job memory limit

Question 3

A large transaction command is causing the search to run out of memory. Which approach best reduces memory usage while maintaining the transaction logic?

Accepted Answer

Use the fields option to include only necessary fields.. Option A is correct because using the fields option limits the fields carried in each event of the transaction, reducing memory. Option B (increasing maxeventtokens) would increase memory usage. Option C (using stats) changes the correlation approach. Option D (timeline) is irrelevant.

Answer

Increase the maxeventtokens setting.

Answer

Replace transaction with stats to aggregate.

Answer

Use timeline to store transactions.

Question 4

Which THREE of the following are correct about the transaction command's default behavior?

Accepted Answer

Transaction groups events by host, source, and sourcetype by default.. Options A, C, and D are correct. Transaction by default groups by host, source, and sourcetype; it does not require startswith/endswith; and it can evict partial transactions if maxpause is exceeded. Option B is false because events can span multiple hosts. Option E is false because keepevicted retains evicted transactions.

Answer

Transaction requires all events to come from the same host.

Answer

Transaction always includes all evicted events in the results.

Question 5

A Splunk search uses 'transaction clientip maxpause=5m'. What does the maxpause setting control?

Accepted Answer

The maximum time gap between events in the transaction.. maxpause sets the maximum inactivity timeout: if no new event for the same clientip arrives within 5 minutes, the transaction is closed.

Answer

The maximum number of transactions allowed.

Answer

The maximum number of events in the transaction.

Answer

The maximum total time span of the transaction.

Question 6

An analyst uses transaction to group web requests by session_id. Some transactions are unexpectedly large, containing hundreds of events. What parameter should be adjusted to limit the number of events per transaction?

Accepted Answer

maxevents. Option B is correct because maxevents limits the number of events in a transaction. Option A (maxspan) limits time, not count. Option C (maxpause) limits idle time. Option D (mvcount) counts multivalue fields, not events.

Answer

maxspan

Answer

maxpause

Answer

mvcount

Question 7

Which two techniques should be used to optimize a transaction search that is slow due to a high volume of events? (Choose two.)

Accepted Answer

Use the 'fields' command to limit fields before transaction.. Options A and D are correct. Using fields before transaction reduces memory and processing. Using stats instead of transaction can be more efficient for some correlations. Option B (local) reduces parallelism. Option C (increasing maxspan) typically increases resource usage. Option E (keepevicted) does not optimize performance.

Answer

Use the 'keepevicted' option to free memory.

Answer

Use the 'local' parameter to process on a single indexer.

Answer

Increase the maxspan value to reduce the number of transactions.

Question 8

Which TWO options are valid parameters of the `transaction` command?

Accepted Answer

maxpause. Correct options: B (maxpause) and D (keepevicted). Option A (timeformat) is for time parsing, not transaction. Option C (fieldlist) is not a parameter; fields are given as arguments. Option E (sequential) is not a parameter.

Answer

timeformat

Answer

sequential

Answer

fieldlist

Question 9

A company has events from multiple data sources that share a common 'request_id'. They want to correlate events from different sources (e.g., web, app, database) into a single transaction per request. However, the timestamps across sources are not synchronized, causing some events to appear out of order. Which approach is best to ensure correct grouping?

Accepted Answer

Use `sort _time | transaction request_id maxspan=10m`. Setting a larger maxspan and using `sort _time` before transaction can help reorder events, but the most reliable method is to use `transaction request_id` with a generous maxspan and, if needed, use `sort 0 _time` before transaction to ensure time order.

Answer

Use `eventstats count by request_id` to correlate counts

Answer

Use `transaction request_id` and rely on Splunk to automatically reorder

Answer

Use `transaction request_id maxspan=1m` and ignore out-of-order events

Question 10

A Splunk administrator is tuning a dashboard that uses `transaction` to correlate web server events. The dashboard frequently times out. The admin reviews the search and sees `transaction client_ip maxspan=1h maxpause=30m`. The dataset contains about 10 million events per hour. The admin suspects that the transaction is causing the timeout. Which action should they take to improve performance while still achieving the grouping?

Accepted Answer

Replace transaction with streamstats to create a session ID, then use stats to aggregate. The current transaction has generous limits. Using `transaction` on a large dataset is memory-intensive. A better approach is to pre-aggregate using `stats` or use `streamstats` to compute session boundaries. Option D is the most practical: use `streamstats` to assign session IDs and then use `stats` to group, which is more efficient.

Answer

Add `maxevents=100` to limit events per transaction

Answer

Reduce maxspan to 15m and maxpause to 5m

Answer

Increase the search job concurrency

Question 11

A Splunk administrator is correlating events from two sourcetypes using transaction with startswith and endswith. The transaction rarely matches events even though they exist. What is the most likely cause?

Accepted Answer

Events from the two sourcetypes are not in chronological order.. Option D is correct because transaction requires events to be in chronological order within the same index and host by default. If events are out of order, they won't be matched. Options A and B are plausible but less common; option C is false.

Answer

The maxpause value is too high.

Answer

The fields option is missing.

Answer

The startswith and endswith patterns are too broad.

Question 12

Refer to the exhibit. The search returns no transactions even though there are login and logout events in the index. What is the most likely cause?

Accepted Answer

The transaction command may be timing out due to large data volume.. Option C is correct because the exhibit shows no fields option; transaction includes all fields, which may exceed memory limits and cause the search to fail silently. Option A is false because maxpause is reasonable. Option B is false because the syntax is correct. Option D is false because sourcetype is present.

Answer

The maxpause value is too short.

Answer

The startswith and endswith options are mispelled.

Answer

The sourcetype is incorrect.

Question 13

An analyst wants to group events from different sourcetypes (web_access and error_log) into a single transaction when they share the same 'request_id' field and occur within 1 minute. Which search correctly accomplishes this?

Accepted Answer

(sourcetype=web_access OR sourcetype=error_log) | transaction request_id maxspan=1m. Using OR to combine sourcetypes and then transaction with maxspan=1m groups events by request_id across both sourcetypes, with a total time limit of 1 minute.

Answer

index=* | transaction request_id maxspan=1m

Answer

index=main | join type=inner request_id [search sourcetype=error_log]

Answer

sourcetype=web_access | transaction request_id maxspan=1m | append [search sourcetype=error_log | transaction request_id maxspan=1m]

Question 14

A Splunk admin notices that a transaction search using the transaction command takes a long time and consumes high memory. The search correlates events by a high-cardinality field (IP address) across multiple indexers. Which optimization technique should be applied first?

Accepted Answer

Use the fields command to remove unnecessary fields before the transaction.. Option C is correct because using the fields command to remove unnecessary fields before the transaction reduces memory and processing. Option A (local) limits to one indexer, reducing parallelism and potentially increasing time. Option B (increasing maxevents) would increase memory. Option D (keepevicted) does not optimize performance.

Answer

Increase maxevents to capture more events per transaction.

Answer

Use the keepevicted option to retain incomplete transactions.

Answer

Use the local parameter to force local processing.

Question 15

A Splunk admin wants to group events from the same user session in web logs. Which transaction option should be used to ensure the transaction ends after 30 minutes of inactivity?

Accepted Answer

maxpause=30m. Option B is correct because maxpause ends the transaction if the time between events exceeds the specified duration. Option A (maxspan) limits total duration, not inactivity. Option C (maxevents) limits the number of events. Option D (keepevicted) retains partial transactions that were evicted.

Answer

keepevicted=true

Answer

maxspan=30m

Answer

maxevents=100