SPLK-1002 Transactions and Event Correlation — 20 Questions

Question 1

A Splunk user needs to correlate events from different sourcetypes (web_access, auth_log, app_log) that share a common 'transaction_id' field. Each transaction_id may appear many times across sourcetypes. The user wants to group all events with the same transaction_id into one transaction, without any time constraints. Which transaction command is most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

transaction by transaction_id. Intended to be A, but note that in Splunk, the `transaction` command does not use a `by` clause; the correct syntax is `transaction transaction_id`. However, among the given options, option A is the only one that groups by `transaction_id` without imposing any time constraints (like `maxspan`) or marker arguments (`startswith`/`endswith`). Option B incorrectly includes `sourcetype` in the grouping, which would split events across sourcetypes. Option C adds a time constraint (`maxspan=1d`) which is not required. Option D adds marker arguments that are not needed. Therefore, despite the syntactical inaccuracy, option A is the most appropriate choice.

Answer

transaction by sourcetype transaction_id

Answer

transaction maxspan=1d by transaction_id

Answer

transaction startswith=* endswith=* by transaction_id

Question 2

Which TWO statements are true about the `transaction` command in Splunk?

Accepted Answer

It can group events based on one or more common field values.. The `transaction` command groups events based on common field values (A) and supports options like maxspan and maxpause to define time boundaries (D). It also automatically adds a `duration` field calculated as the time difference between the first and last event in each transaction (B), and within each transaction, events are automatically sorted by _time in chronological order (E). Option C is false because transaction can correlate events across different sourcetypes if they share common fields.

Answer

It can only correlate events from the same sourcetype.

Question 3

A security team needs to correlate failed login attempts across multiple web servers to identify brute force attacks. Each server logs authentication failures with timestamps and source IPs. The team wants to create a transaction that groups failed attempts within 5 minutes from the same IP, but only if there are at least 3 failures. Which approach correctly implements this requirement?

Accepted Answer

index=web sourcetype=access_combined status=401 | transaction clientip maxspan=5m. Uses the `transaction` command with `maxspan=5m` to group events by `clientip` within a 5-minute window, capturing all failed attempts. To enforce the requirement of at least 3 failures, you would add a filter like `where mvcount(_raw) >= 3` after the transaction. Among the given options, D is the closest because it creates the necessary time-based grouping without incorrectly capping the number of events per transaction (as Option B does with `maxevents=3`, which sets a maximum, not a minimum).

Answer

index=web sourcetype=access_combined status=401 | search clientip=* | head 3

Answer

index=web sourcetype=access_combined status=401 | transaction clientip maxspan=5m maxevents=3

Answer

index=web sourcetype=access_combined status=401 | stats count by clientip, _time

Question 4

A security analyst wants to correlate login events from multiple sources to identify a single user session. The data includes source IP, username, and timestamp. Which Splunk command is most appropriate to group these events into a single transaction based on a common field and a maximum time window?

Accepted Answer

transaction username maxspan=30m. The correct command is 'transaction username maxspan=30m'. This command groups events into a single transaction when they share the same username and occur within a 30-minute time window, which is exactly what the analyst needs to correlate login events into a single user session. Option A (eventstats max(_time) by username) adds a field but does not group events into transactions. Option C (timechart count by username) creates a time series chart, not a transaction. Option D (stats values(username) by sourceip) groups by source IP, not username, and does not create transactions.

Answer

eventstats max(_time) by username

Answer

timechart count by username

Answer

stats values(username) by sourceip

Question 5

A financial company wants to group all events related to a single trading session. The session ID appears in all events. Which is the most efficient way to correlate these events without using transaction?

Accepted Answer

Use stats with values() on the event fields.. Using stats with values() can list all events per session ID efficiently. Option A (sort) reorders by timestamp but does not group events by session. Option C (join) is for lookup, not for grouping events. Option D (append with subsearch) merges results but doesn't group by session ID.

Answer

Use sort to order events by timestamp.

Answer

Use join to combine events on sessionId.

Answer

Use append with a subsearch.

Question 6

An analyst needs to correlate events from two different data sources (web logs and database logs) based on a common session ID. The events occur within a short time window of 5 seconds. Which command is most appropriate?

Accepted Answer

transaction sessionid maxspan=5s. The transaction command groups events sharing a common field, but without additional options it lacks time boundaries. Option B uses maxspan=5s to enforce that only events within 5 seconds of each other are grouped, which directly matches the requirement. Options C and D (join and append) are not designed for correlating across data sources based on a common field within a time window. Therefore, option B is the most appropriate.

Answer

transaction sessionid

Answer

join type=inner sessionid [search index=db]

Answer

append [search index=db]

Question 7

When using the transaction command to group events, which field is automatically added to the event to indicate the start time of the transaction?

Accepted Answer

_time. When using the transaction command, the _time field of each transaction is automatically set to the timestamp of the first event in that transaction, indicating the start time. The transaction command does not add a separate _starttime field.

Answer

duration

Answer

None, the transaction command does not add such a field.

Answer

_starttime

Question 8

A security analyst needs to correlate login events from multiple authentication servers to track a single user session. The events share a common 'session_id' field but have different timestamps. Which transaction command option should be used to ensure the session is considered complete after 30 minutes of inactivity?

Accepted Answer

maxpause=1800. (maxpause=1800) is correct because it sets a maximum inactivity period of 1800 seconds (30 minutes) between events in a transaction. When no new events with the same session_id arrive within that window, the transaction is considered complete. This directly addresses the requirement to end a session after 30 minutes of inactivity, regardless of the total duration of the session.

Answer

startswith=login endswith=logout

Answer

mvlist=session_id

Answer

maxspan=30m

Question 9

A Splunk administrator notices that the 'transaction' command is consuming excessive memory when processing a large dataset. The dataset contains events with a common field 'user_id', and the goal is to group events per user within 1 hour. Which approach would best reduce memory usage while still achieving the desired correlation?

Accepted Answer

Use a subsearch to first filter events and then apply transaction on the smaller set.. Using a subsearch first reduces the dataset size before the 'transaction' command processes it, directly addressing the memory issue. The 'transaction' command groups events into memory until they are finalized, so a smaller input set means fewer events held simultaneously, lowering memory consumption while still allowing the 1-hour maxspan correlation per user_id.

Answer

Use the 'kvform' command instead of transaction.

Answer

Add more fields to the transaction to make it more specific.

Answer

Increase the maxspan value to 2 hours to reduce the number of transactions.

Question 10

A Splunk user wants to group web server logs into transactions representing a single user visit, where a visit starts with a 'GET' request and ends with a 'POST' request. Which transaction command syntax correctly implements this logic?

Accepted Answer

transaction startswith="GET" endswith="POST". The `transaction` command with `startswith="GET"` and `endswith="POST"` correctly groups events into a transaction that begins with a GET request and ends with a POST request, matching the requirement for a single user visit. Options A and D add unnecessary constraints (`maxevents=2` or `by src_ip`) that alter the intended grouping logic, and option B reverses the start and end events, which does not match the specified visit flow.

Answer

transaction startswith="GET" endswith="POST" maxevents=2

Answer

transaction startswith="POST" endswith="GET"

Answer

transaction by src_ip startswith="GET" endswith="POST"

Question 11

A Splunk administrator is troubleshooting a slow search that uses the transaction command. The search correlates events by 'user_uuid' with a maxspan of 1 hour. The administrator suspects that many orphan events (events that never complete a transaction) are causing performance issues. Which approach can help identify and possibly exclude orphan events from the transaction?

Accepted Answer

Use the 'keepevicted=true' option and then filter out evicted events in a subsequent search.. The `keepevicted=true` parameter causes the `transaction` command to output events that were evicted from the transaction window (orphans) with an `evicted` field set to 1. You can then filter out these evicted events in a subsequent search using `where evicted=0`, which isolates only complete transactions and removes the performance overhead of orphan events.

Answer

Increase maxspan to allow more events to complete.

Answer

Use the 'mvlist' option to list all user_uuid values.

Answer

Add 'closed_txn=1' to the transaction command to only output complete transactions.

Question 12

Which TWO statements about the 'transaction' command are correct? (Choose two.)

Accepted Answer

It can use the 'by' clause to group events based on common field values.. The 'transaction' command can use a 'by' clause to group events that share common field values into a single transaction. This allows you to correlate events from different sources or sourcetypes as long as they have matching field values, enabling flexible event correlation.

Answer

It requires all events to be from the same source.

Answer

It sums numeric field values across events in the transaction.

Answer

The 'maxevents' option limits the total number of transactions output.

Question 13

Which THREE conditions must be met for events to be grouped into the same transaction when using the 'transaction' command without any 'startswith' or 'endswith' options? (Choose three.)

Accepted Answer

Events must have the same value in the field specified by the 'by' clause.. The 'by' clause in the 'transaction' command defines a field whose value must be identical across all events in a transaction. Without 'startswith' or 'endswith', the transaction command groups events solely based on the 'by' field, the 'maxspan' time window, and the 'maxpause' gap between consecutive events. This ensures that only events sharing the same field value are considered part of the same logical transaction.

Answer

Events must be from the same sourcetype.

Answer

Events must appear in chronological order with no missing timestamps.

Question 14

Refer to the exhibit. A Splunk user runs the search shown. The search returns results, but the user notices that some clientip values appear multiple times in the stats output, even though they should have been grouped into a single transaction. What is the most likely reason for this?

Accepted Answer

The maxevents option prevents more than 5 events from being grouped into one transaction, so additional events form separate transactions.. The `transaction` command's `maxevents` option limits the maximum number of events that can be grouped into a single transaction. When more than 5 events exist for a given `clientip`, the extra events cannot be included in the first transaction and instead form separate transactions, causing the same `clientip` to appear multiple times in the `stats` output.

Answer

The sourcetype filter is excluding some events.

Answer

The stats command is not correctly summing the counts.

Answer

The maxspan is too short to capture all events for each clientip.

Question 15

Refer to the exhibit. A security analyst runs this search to group SSH login events into sessions based on a session_id that is extracted only from 'Accepted publickey' events. However, the resulting transactions contain only the 'Accepted publickey' event and none of the subsequent commands or logouts. What is the most likely cause?

Accepted Answer

The session_id field is only populated for the 'Accepted publickey' event, so other events have a different or null session_id and do not join the transaction.. The `transaction` command groups events by the `session_id` field. If `session_id` is only extracted from 'Accepted publickey' events (e.g., via a `rex` or `eval` command), subsequent commands and logout events will have a null or different `session_id`. Since `transaction` requires all events in the group to share the same `session_id` value, those other events cannot join the transaction, resulting in a transaction containing only the single 'Accepted publickey' event.

Answer

The maxpause=5m is too short, causing the transaction to close before other events occur.

Answer

The transaction command requires that all events have a non-null session_id to be grouped.

Answer

The sourcetype filter is too restrictive.

Question 16

An analyst needs to correlate events from a web server log and an application log to identify failed login attempts followed within 5 seconds by an error event. The events share a common session ID field. Which approach should the analyst use?

Accepted Answer

Use `transaction sessionID maxspan=5s` to group events by session ID within 5 seconds. The `transaction` command is designed to group related events based on shared field values (sessionID) within a specified time boundary (maxspan=5s). This allows the analyst to correlate web server and application log events that share the same session ID and occur within 5 seconds, making it straightforward to identify failed login attempts followed by an error event.

Answer

Use `append` to combine the two sourcetypes and then `search` for the pattern

Answer

Use `eventstats` to compute counts by sessionID and then filter

Answer

Use `stats` with values() and a by clause on sessionID

Question 17

A security team wants to detect a multi-step attack pattern: a user logs in from a new IP address, then within 10 minutes performs a privilege escalation, and finally accesses a sensitive file. They have events with fields: user, ip, action, and timestamp. Which SPL transaction statement should they use to group these three events into one transaction, ensuring all three actions occur in order?

Accepted Answer

`transaction user maxspan=10m`. `transaction user maxspan=10m` groups all events from the same user that occur within a 10-minute window. The events are inherently ordered by timestamp, so the three actions (login, privilege escalation, sensitive file access) will appear in chronological order within the transaction, satisfying the requirement. Including `action` or `ip` in the transaction fields would split the three different actions or IP addresses into separate transactions, preventing detection of the complete pattern.

Answer

`transaction user,ip,action maxspan=10m`

Answer

`transaction user maxpause=30s`

Answer

`transaction user mvcount=3`

Question 18

A Splunk administrator notices that a transaction command is consuming excessive memory and taking too long to complete. The transaction is defined on a field with high cardinality. Which of the following would most effectively reduce memory usage and improve performance?

Accepted Answer

Use a different field with lower cardinality for grouping. The transaction command groups events based on field values, and high cardinality fields create many unique groups, each requiring memory for state tracking. Using a lower-cardinality field reduces the number of concurrent groups, directly lowering memory consumption and processing time. This addresses the root cause rather than adjusting timeouts or eviction policies.

Answer

Increase the maxspan value

Answer

Remove the maxspan constraint

Answer

Set keepevicted=false

Question 19

A Splunk user wants to correlate events from different sourcetypes (web_access, app_log) that belong to the same user session identified by session_id. The events should be grouped only if they occur within 30 minutes of each other, and each transaction should contain at least one event from each sourcetype. Which SPL construct should they use?

Accepted Answer

`transaction session_id maxspan=30m`. The `transaction` command groups events that share a common field (`session_id`) and allows you to set constraints like `maxspan=30m` to limit the time window between the first and last event in the transaction. However, `transaction` does not automatically require events from both sourcetypes; grouping is based solely on the session_id field. To ensure each transaction contains at least one event from both `web_access` and `app_log`, you would need to add a subsequent filter, such as `| where mvcount(sourcetype) > 1`. Nevertheless, option B is the correct construct because it groups events by session_id within the time window, and the additional requirement can be applied afterward. The other options fail to enforce the 30-minute window or the presence of both sourcetypes.

Answer

`append [search sourcetype=app_log]` then sort by session_id

Answer

`sourcetype=web_access OR sourcetype=app_log | eval session=session_id` then `stats values(*) as * by session`

Answer

`join type=inner session_id [search sourcetype=app_log]` after a search on web_access

Question 20

An organization has a transaction that groups firewall events by source IP to detect port scans. The transaction uses `maxpause=1m`. Some valid scans are being missed because events occasionally have gaps longer than 1 minute due to network latency. Which change would best capture these scans without introducing too many false positives?

Accepted Answer

Increase maxpause to 2 minutes. Increasing maxpause to 2 minutes allows the transaction to tolerate longer gaps between events caused by network latency, ensuring that valid port scans are still captured. This change directly addresses the issue without altering the grouping logic or removing the timeout guard, which would otherwise risk false positives or incorrect grouping.

Answer

Decrease maxspan to 30 seconds

Answer

Remove maxpause and use only maxspan

Answer

Group by destination IP instead of source IP