SPLK-1003 Transactions and Event Correlation — 15 Questions

Question 1

A security analyst needs to correlate login events from multiple authentication servers to track a single user session. The events share a common 'session_id' field but have different timestamps. Which transaction command option should be used to ensure the session is considered complete after 30 minutes of inactivity?

Accepted Answer

maxpause=1800. Option D (maxpause=1800) is correct because it sets a maximum inactivity period of 1800 seconds (30 minutes) between events in a transaction. When no new events with the same session_id arrive within that window, the transaction is considered complete. This directly addresses the requirement to end a session after 30 minutes of inactivity, regardless of the total duration of the session.

Answer

startswith=login endswith=logout

Answer

mvlist=session_id

Answer

maxspan=30m

Question 2

A Splunk administrator notices that the 'transaction' command is consuming excessive memory when processing a large dataset. The dataset contains events with a common field 'user_id', and the goal is to group events per user within 1 hour. Which approach would best reduce memory usage while still achieving the desired correlation?

Accepted Answer

Use a subsearch to first filter events and then apply transaction on the smaller set.. Option B is correct because using a subsearch first reduces the dataset size before the 'transaction' command processes it, directly addressing the memory issue. The 'transaction' command groups events into memory until they are finalized, so a smaller input set means fewer events held simultaneously, lowering memory consumption while still allowing the 1-hour maxspan correlation per user_id.

Answer

Use the 'kvform' command instead of transaction.

Answer

Add more fields to the transaction to make it more specific.

Answer

Increase the maxspan value to 2 hours to reduce the number of transactions.

Question 3

A Splunk user wants to group web server logs into transactions representing a single user visit, where a visit starts with a 'GET' request and ends with a 'POST' request. Which transaction command syntax correctly implements this logic?

Accepted Answer

transaction startswith="GET" endswith="POST". Option C is correct because the `transaction` command with `startswith="GET"` and `endswith="POST"` groups events into a single transaction that begins with a GET request and ends with a POST request, which matches the requirement for a user visit. The `startswith` and `endswith` arguments define the boundary events for the transaction, and no additional constraints like `maxevents` or `by` fields are needed to implement the basic logic.

Answer

transaction startswith="GET" endswith="POST" maxevents=2

Answer

transaction startswith="POST" endswith="GET"

Answer

transaction by src_ip startswith="GET" endswith="POST"

Question 4

A Splunk administrator is troubleshooting a slow search that uses the transaction command. The search correlates events by 'user_uuid' with a maxspan of 1 hour. The administrator suspects that many orphan events (events that never complete a transaction) are causing performance issues. Which approach can help identify and possibly exclude orphan events from the transaction?

Accepted Answer

Use the 'keepevicted=true' option and then filter out evicted events in a subsequent search.. Option C is correct because the `keepevicted=true` parameter causes the `transaction` command to output events that were evicted from the transaction window (orphans) with an `evicted` field set to 1. You can then filter out these evicted events in a subsequent search using `where evicted=0`, which isolates only complete transactions and removes the performance overhead of orphan events.

Answer

Increase maxspan to allow more events to complete.

Answer

Use the 'mvlist' option to list all user_uuid values.

Answer

Add 'closed_txn=1' to the transaction command to only output complete transactions.

Question 5

A Splunk user needs to correlate events from different sourcetypes (web_access, auth_log, app_log) that share a common 'transaction_id' field. Each transaction_id may appear many times across sourcetypes. The user wants to group all events with the same transaction_id into one transaction, without any time constraints. Which transaction command is most appropriate?

Accepted Answer

transaction by transaction_id. Option A is correct because the `transaction` command with `by transaction_id` groups all events sharing the same `transaction_id` field value into a single transaction, with no default time constraints. This matches the requirement to correlate events across `web_access`, `auth_log`, and `app_log` sourcetypes without any time window restrictions.

Answer

transaction by sourcetype transaction_id

Answer

transaction maxspan=1d by transaction_id

Answer

transaction startswith=* endswith=* by transaction_id

Question 6

Which TWO statements about the 'transaction' command are correct? (Choose two.)

Accepted Answer

It can use the 'by' clause to group events based on common field values.. Option C is correct because the 'transaction' command can use a 'by' clause to group events that share common field values into a single transaction. This allows you to correlate events from different sources or sourcetypes as long as they have matching field values, enabling flexible event correlation.

Answer

It requires all events to be from the same source.

Answer

It sums numeric field values across events in the transaction.

Answer

The 'maxevents' option limits the total number of transactions output.

Question 7

Which THREE conditions must be met for events to be grouped into the same transaction when using the 'transaction' command without any 'startswith' or 'endswith' options? (Choose three.)

Accepted Answer

Events must have the same value in the field specified by the 'by' clause.. Option A is correct because the 'by' clause in the 'transaction' command defines a field whose value must be identical across all events in a transaction. Without 'startswith' or 'endswith', the transaction command groups events solely based on the 'by' field, the 'maxspan' time window, and the 'maxpause' gap between consecutive events. This ensures that only events sharing the same field value are considered part of the same logical transaction.

Answer

Events must be from the same sourcetype.

Answer

Events must appear in chronological order with no missing timestamps.

Question 8

Refer to the exhibit. A Splunk user runs the search shown. The search returns results, but the user notices that some clientip values appear multiple times in the stats output, even though they should have been grouped into a single transaction. What is the most likely reason for this?

Accepted Answer

The maxevents option prevents more than 5 events from being grouped into one transaction, so additional events form separate transactions.. Option D is correct because the `transaction` command's `maxevents` option limits the maximum number of events that can be grouped into a single transaction. When more than 5 events exist for a given `clientip`, the extra events cannot be included in the first transaction and instead form separate transactions, causing the same `clientip` to appear multiple times in the `stats` output.

Answer

The sourcetype filter is excluding some events.

Answer

The stats command is not correctly summing the counts.

Answer

The maxspan is too short to capture all events for each clientip.

Question 9

Refer to the exhibit. A security analyst runs this search to group SSH login events into sessions based on a session_id that is extracted only from 'Accepted publickey' events. However, the resulting transactions contain only the 'Accepted publickey' event and none of the subsequent commands or logouts. What is the most likely cause?

Accepted Answer

The session_id field is only populated for the 'Accepted publickey' event, so other events have a different or null session_id and do not join the transaction.. Option B is correct because the `transaction` command groups events by the `session_id` field. If `session_id` is only extracted from 'Accepted publickey' events (e.g., via a `rex` or `eval` command), subsequent commands and logout events will have a null or different `session_id`. Since `transaction` requires all events in the group to share the same `session_id` value, those other events cannot join the transaction, resulting in a transaction containing only the single 'Accepted publickey' event.

Answer

The maxpause=5m is too short, causing the transaction to close before other events occur.

Answer

The transaction command requires that all events have a non-null session_id to be grouped.

Answer

The sourcetype filter is too restrictive.

Question 10

An analyst needs to correlate events from a web server log and an application log to identify failed login attempts followed within 5 seconds by an error event. The events share a common session ID field. Which approach should the analyst use?

Accepted Answer

Use `transaction sessionID maxspan=5s` to group events by session ID within 5 seconds. The `transaction` command is designed to group related events based on shared field values (sessionID) within a specified time boundary (maxspan=5s). This allows the analyst to correlate web server and application log events that share the same session ID and occur within 5 seconds, making it straightforward to identify failed login attempts followed by an error event.

Answer

Use `append` to combine the two sourcetypes and then `search` for the pattern

Answer

Use `eventstats` to compute counts by sessionID and then filter

Answer

Use `stats` with values() and a by clause on sessionID

Question 11

A security team wants to detect a multi-step attack pattern: a user logs in from a new IP address, then within 10 minutes performs a privilege escalation, and finally accesses a sensitive file. They have events with fields: user, ip, action, and timestamp. Which SPL transaction statement should they use to group these three events into one transaction, ensuring all three actions occur in order?

Accepted Answer

`transaction user maxspan=10m`. Option B is correct because the `transaction` command groups events by the `user` field, and the `maxspan=10m` parameter ensures the entire transaction (all three events) completes within 10 minutes. This allows the three actions (login, privilege escalation, sensitive file access) to occur in any order within that time window, but the security team's requirement is that they occur in sequence; however, `transaction` does not enforce order—it only groups events that share the same `user` and fall within the time span. For strict ordering, you would need to use `transaction` with `ordered=t` or a subsearch, but the question asks for grouping these three events into one transaction, and `transaction user maxspan=10m` is the correct SPL to group all events for the same user within 10 minutes.

Answer

`transaction user,ip,action maxspan=10m`

Answer

`transaction user maxpause=30s`

Answer

`transaction user mvcount=3`

Question 12

A Splunk administrator notices that a transaction command is consuming excessive memory and taking too long to complete. The transaction is defined on a field with high cardinality. Which of the following would most effectively reduce memory usage and improve performance?

Accepted Answer

Use a different field with lower cardinality for grouping. Option D is correct because the transaction command groups events based on field values, and high cardinality fields create many unique groups, each requiring memory for state tracking. Using a lower-cardinality field reduces the number of concurrent groups, directly lowering memory consumption and processing time. This addresses the root cause rather than adjusting timeouts or eviction policies.

Answer

Increase the maxspan value

Answer

Remove the maxspan constraint

Answer

Set keepevicted=false

Question 13

A Splunk user wants to correlate events from different sourcetypes (web_access, app_log) that belong to the same user session identified by session_id. The events should be grouped only if they occur within 30 minutes of each other, and each transaction should contain at least one event from each sourcetype. Which SPL construct should they use?

Accepted Answer

`transaction session_id maxspan=30m`. The `transaction` command groups events that share a common field (`session_id`) and allows you to set constraints like `maxspan=30m` to limit the time window between the first and last event in the transaction. By default, `transaction` requires at least one event from each sourcetype present in the search, which satisfies the requirement that each transaction contains at least one event from both `web_access` and `app_log`. This is the correct construct for correlating events across sourcetypes with a time-bound grouping.

Answer

`append [search sourcetype=app_log]` then sort by session_id

Answer

`sourcetype=web_access OR sourcetype=app_log | eval session=session_id` then `stats values(*) as * by session`

Answer

`join type=inner session_id [search sourcetype=app_log]` after a search on web_access

Question 14

An organization has a transaction that groups firewall events by source IP to detect port scans. The transaction uses `maxpause=1m`. Some valid scans are being missed because events occasionally have gaps longer than 1 minute due to network latency. Which change would best capture these scans without introducing too many false positives?

Accepted Answer

Increase maxpause to 2 minutes. Increasing maxpause to 2 minutes allows the transaction to tolerate longer gaps between events caused by network latency, ensuring that valid port scans are still captured. This change directly addresses the issue without altering the grouping logic or removing the timeout guard, which would otherwise risk false positives or incorrect grouping.

Answer

Decrease maxspan to 30 seconds

Answer

Remove maxpause and use only maxspan

Answer

Group by destination IP instead of source IP

Question 15

Which TWO statements are true about the `transaction` command in Splunk?

Accepted Answer

It can group events based on one or more common field values.. Option A is correct because the `transaction` command groups events that share one or more common field values, such as `session_id` or `user_id`, into a single transaction. This allows you to correlate related events across different sources or sourcetypes based on matching field values.

Answer

It automatically calculates the duration between the first and last event.

Answer

It can only correlate events from the same sourcetype.

Answer

It automatically sorts events in chronological order within each transaction.