SPLK-1003 Practice Test 26 — 15 Questions

Question 1

Refer to the exhibit. A security analyst runs the above search. Which of the following best describes the result?

Accepted Answer

Transactions beginning with 'allow' and ending with 'deny' for src_ip 10.0.0.1, with a maximum duration of 5 minutes. Option C is correct because the transaction groups events by src_ip, starts with 'allow' and ends with 'deny', and limits to 5-minute windows. Events within that window that fit the pattern will form transactions. Option A is incorrect because it says 'all events' but the start/end conditions filter. Option B is incorrect because it reverses start/end. Option D is incorrect because maxspan is 5 minutes, not 1 hour.

Answer

Transactions for all source IPs, but only showing src_ip 10.0.0.1 in the table

Answer

Transactions of all firewall events for src_ip 10.0.0.1, each lasting up to 5 minutes

Answer

Transactions of src_ip 10.0.0.1 that start with deny and end with allow

Question 2

An analyst writes `transaction client_ip` to group events from a firewall. The resulting transactions show many events with duration=0. What is the most likely cause?

Accepted Answer

There is only one event per client_ip in the time range. A duration of 0 often occurs when there is only one event in the transaction. This can happen if the events do not meet the criteria for starting or ending a transaction, or if the maxpause is too short.

Answer

The client_ip field contains duplicates

Answer

The transaction option maxspan is set too high

Answer

The events are not time-stamped properly

Question 3

An administrator runs a transaction command that groups events by a customer ID but notices that some transactions are missing expected events. The log shows that the events are present and within the maxpause. What could be the reason?

Accepted Answer

Events are from different hosts or sources.. Option C is correct because by default transaction groups events by host and source as well. If events for the same customer ID come from different hosts, they are not grouped. Option A is false because maxpause is fine. Option B is irrelevant. Option D is a best practice not a cause.

Answer

The startswith and endswith are conflicting.

Answer

The fields option is missing.

Answer

The maxpause value is too short.

Question 4

A security analyst wants to group all events from a single web session into one transaction. The session is identified by a 'sessionId' field, and events are generated over a period that can last up to 30 minutes. The analyst also wants to close the transaction if there is no activity for more than 10 minutes. Which transaction parameters should be used?

Accepted Answer

maxspan=30m, maxpause=10m. The maxspan parameter sets the maximum total duration of the transaction, while maxpause sets the inactivity timeout. Option A correctly specifies maxspan=30m and maxpause=10m.

Answer

maxspan=30m, maxpause=5m

Answer

maxspan=10m, maxpause=30m

Answer

maxspan=1h, maxpause=10m

Question 5

Which THREE of the following are valid ways to correlate events in Splunk? (Select exactly 3 correct answers.)

Accepted Answer

Using the join command with a common field.. Transaction groups events based on common fields. Join can correlate events from two searches. Stats with values can also correlate by grouping events into a single result. Append and subsearch do not perform correlation.

Answer

Using the subsearch command.

Answer

Using the append command.

Question 6

A transaction search is processing too many fields. Which command should be used immediately before the transaction command to reduce memory usage?

Accepted Answer

fields user_id, _time. Option C is correct because 'fields user_id, _time' keeps only the essential fields. Option A is incorrect because it removes _raw and _time, but keeps other fields. Option B is incorrect because 'fields - * except user_id' removes _time. Option D is incorrect because 'fields +' appends, not replaces.

Answer

fields - _raw, _time

Answer

fields + user_id, _time

Answer

fields - * except user_id

Question 7

A Splunk admin wants to group events that share a common `session_id` field. Events arrive out of order. Which transaction field will automatically sort events correctly?

Accepted Answer

transaction automatically sorts by time. Option C is correct because `transaction` automatically sorts events by time within each transaction. Option A (sort) is not a transaction option. Option B (index order) is not guaranteed. Option D (timeordered) is not a valid option.

Answer

sort=_time

Answer

Use option `timeordered=true`

Answer

No sorting needed; events are indexed in order

Question 8

Refer to the exhibit. An analyst runs the above search to test transaction behavior. What is the likely result?

Accepted Answer

Multiple transactions, each with fewer events, avg duration less than 10s. Option D is correct because maxspan=10s limits the total time window; with random timestamps spread over up to 100 seconds, most events will not fit within a 10-second window, so transactions will be split into multiple groups. The avg(duration) will be small. Option A is wrong because not all 5 events are in one transaction. Option B is wrong because duration is not constant. Option C is wrong because transactions will be created but split.

Answer

One transaction with 5 events, avg duration ~50s

Answer

One transaction with 5 events, avg duration ~10s

Answer

No transactions created because events are out of order

Question 9

Which TWO options can be used with the `transaction` command to control how many events are included in a single transaction?

Accepted Answer

maxspan. maxevents limits the number of events per transaction. maxspan limits the time span, indirectly limiting events. maxpause limits the pause between events.

Answer

mvcount

Answer

maxpause

Answer

keepevicted

Question 10

Which command is best for calculating a running total of sales per customer across events without creating a multivalued field?

Accepted Answer

streamstats. Option C is correct because streamstats can compute a running total per customer. Option A (eventstats) adds an aggregate but not per-row progression. Option B (stats) is for aggregation, not running. Option D (transaction) groups events but does not compute running totals.

Answer

stats

Answer

transaction

Answer

eventstats

Question 11

An analyst needs to correlate events from two different data sources (web logs and database logs) based on a common session ID. The events occur within a short time window of 5 seconds. Which command is most appropriate?

Accepted Answer

transaction sessionid. The transaction command is designed to group events that share a common field, regardless of source, and can be constrained with maxspan. Option A is the most direct and efficient method.

Answer

transaction sessionid maxspan=5s

Answer

join type=inner sessionid [search index=db]

Answer

append [search index=db]

Question 12

Which THREE strategies can help reduce memory usage when using the transaction command? (Select exactly 3 correct answers.)

Accepted Answer

Filter events before the transaction command.. Reducing maxspan and maxpause limits the time window, thus fewer open transactions. Filtering events early and using the fields command to limit fields reduce data volume. Increasing maxopentxn and keepevicted=true increase memory usage.

Answer

Use keepevicted=true.

Answer

Increase maxopentxn.

Question 13

An analyst wants to find transactions where the first event was a 'login' and the last event was a 'logout'. Which post-transaction filter is correct?

Accepted Answer

where mvindex(action,0)="login" AND mvindex(action,-1)="logout". Option A is correct because mvindex accesses the first (index=0) and last (index=-1) values of a multivalue field. Option B uses invalid syntax. Option C uses nonexistent functions. Option D would match if both values appear anywhere, not necessarily first/last.

Answer

where action[0]="login" AND action[-1]="logout"

Answer

where first(action)="login" AND last(action)="logout"

Answer

where action="login" AND action="logout"

Question 14

A search includes `... | transaction 1,2,3` but returns unexpected results. What does the `1,2,3` represent in this context?

Accepted Answer

maxspan=1s, maxpause=2s, maxevents=3. Option B is correct because `transaction` without named fields uses `maxspan` as the first argument, `maxpause` as second, and `maxevents` as third, all in seconds. Option A is wrong because it's not index. Option C is wrong because it's not status. Option D is wrong because it's not field list.

Answer

Field names to use as transaction keys

Answer

Three index names to correlate across indexes

Answer

Status codes for transactions (1=open, 2=pending, 3=closed)

Question 15

Which THREE statements about the `transaction` command are true?

Accepted Answer

Transaction can correlate events based on more than one field.. Transaction can group events by multiple fields, calculates duration for start/end events, and can include field values from all constituent events. However, it does not support use of `where` before transaction in the same search pipeline? Actually, it can be used after. Options: A: true, B: false (maxpause limits pause, not span), C: true, D: true, E: false (transaction is memory-intensive, not recommended for large datasets).

Answer

The maxpause option sets the maximum time span of the transaction.

Answer

Transaction is the most efficient way to group events from large datasets.

SPLK-1003 Practice Test 26 — 15 Questions

Exhibit

SPLK-1003 Practice Test 26 — 15 Questions

Exhibit