SPLK-1002 Transactions and Event Correlation — 10 Questions

Question 1

A Splunk administrator notices that the 'transaction' command is consuming excessive memory when processing a large dataset. The dataset contains events with a common field 'user_id', and the goal is to group events per user within 1 hour. Which approach would best reduce memory usage while still achieving the desired correlation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a subsearch to first filter events and then apply transaction on the smaller set.. Using a subsearch first reduces the dataset size before the 'transaction' command processes it, directly addressing the memory issue. The 'transaction' command groups events into memory until they are finalized, so a smaller input set means fewer events held simultaneously, lowering memory consumption while still allowing the 1-hour maxspan correlation per user_id.

Answer

Use the 'kvform' command instead of transaction.

Answer

Add more fields to the transaction to make it more specific.

Answer

Increase the maxspan value to 2 hours to reduce the number of transactions.

Question 2

A Splunk administrator is troubleshooting a slow search that uses the transaction command. The search correlates events by 'user_uuid' with a maxspan of 1 hour. The administrator suspects that many orphan events (events that never complete a transaction) are causing performance issues. Which approach can help identify and possibly exclude orphan events from the transaction?

Accepted Answer

Use the 'keepevicted=true' option and then filter out evicted events in a subsequent search.. The `keepevicted=true` parameter causes the `transaction` command to output events that were evicted from the transaction window (orphans) with an `evicted` field set to 1. You can then filter out these evicted events in a subsequent search using `where evicted=0`, which isolates only complete transactions and removes the performance overhead of orphan events.

Answer

Increase maxspan to allow more events to complete.

Answer

Use the 'mvlist' option to list all user_uuid values.

Answer

Add 'closed_txn=1' to the transaction command to only output complete transactions.

Question 3

A Splunk user needs to correlate events from different sourcetypes (web_access, auth_log, app_log) that share a common 'transaction_id' field. Each transaction_id may appear many times across sourcetypes. The user wants to group all events with the same transaction_id into one transaction, without any time constraints. Which transaction command is most appropriate?

Accepted Answer

transaction by transaction_id. Intended to be A, but note that in Splunk, the `transaction` command does not use a `by` clause; the correct syntax is `transaction transaction_id`. However, among the given options, option A is the only one that groups by `transaction_id` without imposing any time constraints (like `maxspan`) or marker arguments (`startswith`/`endswith`). Option B incorrectly includes `sourcetype` in the grouping, which would split events across sourcetypes. Option C adds a time constraint (`maxspan=1d`) which is not required. Option D adds marker arguments that are not needed. Therefore, despite the syntactical inaccuracy, option A is the most appropriate choice.

Answer

transaction by sourcetype transaction_id

Answer

transaction maxspan=1d by transaction_id

Answer

transaction startswith=* endswith=* by transaction_id

Question 4

Which TWO statements about the 'transaction' command are correct? (Choose two.)

Accepted Answer

It can use the 'by' clause to group events based on common field values.. Option C is correct because the transaction command supports a 'by' clause (e.g., transaction by user_id) that groups related events sharing common field values into the same transaction. Option E is correct because transaction's core purpose is to merge multiple related events into a single combined event, joining their fields and preserving the raw events. Option A is incorrect because transaction does not require events to come from the same source; it can group events across different sources or hosts. Option B is incorrect because transaction does not sum numeric field values; that is the role of stats sum() or addtotals. Option D is incorrect because maxevents limits the number of events per transaction, not the total number of transactions output (that would be maxopentxn or similar constraints).

Answer

It requires all events to be from the same source.

Answer

It sums numeric field values across events in the transaction.

Answer

The 'maxevents' option limits the total number of transactions output.

Question 5

Which THREE conditions must be met for events to be grouped into the same transaction when using the 'transaction' command without any 'startswith' or 'endswith' options? (Choose three.)

Accepted Answer

Events must have the same value in the field specified by the 'by' clause.. When the transaction command is used without startswith or endswith, grouping is driven by the by clause, maxspan, and maxpause. Option A is correct because events are only grouped together if they share the same value in the field named by the by clause, which defines the transaction boundaries. Option B is correct because maxspan sets the maximum allowed time between the first and last event in a transaction, so the total span must not exceed that value. Option D is correct because maxpause limits the maximum time gap between consecutive events, and any larger gap breaks the transaction. Option C is not required, since transactions can span different sourcetypes as long as the by, maxspan, and maxpause conditions are satisfied. Option E is not required, because Splunk assigns timestamps to events and does not require a special chronological or no-missing-timestamp condition for transaction grouping.

Answer

Events must be from the same sourcetype.

Answer

Events must appear in chronological order with no missing timestamps.

Question 6

Refer to the exhibit. A Splunk user runs the search shown. The search returns results, but the user notices that some clientip values appear multiple times in the stats output, even though they should have been grouped into a single transaction. What is the most likely reason for this?

Accepted Answer

The maxevents option prevents more than 5 events from being grouped into one transaction, so additional events form separate transactions.. The `transaction` command's `maxevents` option limits the maximum number of events that can be grouped into a single transaction. When more than 5 events exist for a given `clientip`, the extra events cannot be included in the first transaction and instead form separate transactions, causing the same `clientip` to appear multiple times in the `stats` output.

Answer

The sourcetype filter is excluding some events.

Answer

The stats command is not correctly summing the counts.

Answer

The maxspan is too short to capture all events for each clientip.

Question 7

A security team wants to detect a multi-step attack pattern: a user logs in from a new IP address, then within 10 minutes performs a privilege escalation, and finally accesses a sensitive file. They have events with fields: user, ip, action, and timestamp. Which SPL transaction statement should they use to group these three events into one transaction, ensuring all three actions occur in order?

Accepted Answer

`transaction user maxspan=10m`. `transaction user maxspan=10m` groups all events from the same user that occur within a 10-minute window. The events are inherently ordered by timestamp, so the three actions (login, privilege escalation, sensitive file access) will appear in chronological order within the transaction, satisfying the requirement. Including `action` or `ip` in the transaction fields would split the three different actions or IP addresses into separate transactions, preventing detection of the complete pattern.

Answer

`transaction user,ip,action maxspan=10m`

Answer

`transaction user maxpause=30s`

Answer

`transaction user mvcount=3`

Question 8

A Splunk user wants to correlate events from different sourcetypes (web_access, app_log) that belong to the same user session identified by session_id. The events should be grouped only if they occur within 30 minutes of each other, and each transaction should contain at least one event from each sourcetype. Which SPL construct should they use?

Accepted Answer

`transaction session_id maxspan=30m`. The `transaction` command groups events that share a common field (`session_id`) and allows you to set constraints like `maxspan=30m` to limit the time window between the first and last event in the transaction. However, `transaction` does not automatically require events from both sourcetypes; grouping is based solely on the session_id field. To ensure each transaction contains at least one event from both `web_access` and `app_log`, you would need to add a subsequent filter, such as `| where mvcount(sourcetype) > 1`. Nevertheless, option B is the correct construct because it groups events by session_id within the time window, and the additional requirement can be applied afterward. The other options fail to enforce the 30-minute window or the presence of both sourcetypes.

Answer

`append [search sourcetype=app_log]` then sort by session_id

Answer

`sourcetype=web_access OR sourcetype=app_log | eval session=session_id` then `stats values(*) as * by session`

Answer

`join type=inner session_id [search sourcetype=app_log]` after a search on web_access

Question 9

Which TWO statements are true about the `transaction` command in Splunk?

Accepted Answer

It can group events based on one or more common field values.. The `transaction` command groups events based on common field values (A) and supports options like maxspan and maxpause to define time boundaries (D). It also automatically adds a `duration` field calculated as the time difference between the first and last event in each transaction (B), and within each transaction, events are automatically sorted by _time in chronological order (E). Option C is false because transaction can correlate events across different sourcetypes if they share common fields.

Answer

It can only correlate events from the same sourcetype.

Question 10

Which THREE of the following are valid use cases for the `transaction` command in Splunk?

Accepted Answer

Identifying a sequence of events that indicate a brute-force attack (multiple failed logins followed by a success).. Option A is correct because transaction is designed to group related events by fields such as src_ip and can enforce an ordered sequence with startswith/endswith (e.g., failed login then success), which is exactly how a brute-force pattern is detected. Option C is correct because transaction can group events sharing a common identifier like session ID or user across multiple web servers, joining them into a single correlated transaction spanning hosts. Option E is correct because transaction can correlate a customer's browsing events with a later purchase event using a shared customer/session key, enabling conversion-rate analysis. Option B is not a valid use case because counting events within a transaction is done with the where clause on eventcount (e.g., ... | where eventcount > 5) or with stats, not by transaction itself. Option D is not a valid use case because enriching events with external CSV data is performed with lookup, not transaction.

Answer

Generating an alert when a transaction contains more than five events.

Answer

Enriching events with external data from a CSV file based on a common key.