SPLK-1002 Transactions and Event Correlation Practice Test 10 — 15 Questions

Question 1

A network operations team monitors firewall logs using Splunk. They need to group events from the same TCP session, identified by 'src_ip', 'dst_ip', and 'src_port'. The logs contain events for 'session_start', 'data_transfer', and 'session_end' actions. They currently use `transaction src_ip dst_ip src_port startswith=action=session_start endswith=action=session_end`. However, many transactions are incomplete because some sessions do not have a 'session_end' event due to firewall timeouts. The team wants to include these incomplete sessions as well, but still group them around a start event. What should they modify?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Remove endswith and add maxspan=30m. To include incomplete sessions without an 'session_end' event, remove the `endswith` clause and add a `maxspan` time limit. This ensures that transactions are automatically closed after the specified time (30 minutes) if no end event is encountered. The `startswith` clause remains to initiate transactions only on 'session_start' events. Option B correctly implements this: `transaction src_ip dst_ip src_port startswith=action=session_start maxspan=30m`. This way, sessions that timeout are still captured as transactions.

Answer

Add `maxspan=30m` and keep endswith

Answer

Change startswith to `action=session_start OR action=session_end`

Answer

Use `transaction src_ip dst_ip src_port maxspan=30m` without startswith or endswith

Question 2

A financial services company uses Splunk to correlate events from multiple applications. Analysts often use `transaction user_id` to group events, but they notice that this command significantly increases search time and memory usage. After investigating, they find that certain 'user_id' values are extremely frequent (e.g., service accounts) causing huge transactions with thousands of events, which exhaust search memory. The team needs to continue grouping by user_id but must avoid performance issues. They also need to preserve the ability to compute statistics like transaction duration. Which approach best addresses both concerns?

Accepted Answer

Use `transaction user_id maxspan=5m maxevents=100`. The `transaction` command's memory and runtime scale with the size of the largest transaction, so unbounded grouping by a high-cardinality field like user_id (with service accounts generating thousands of events) causes memory exhaustion. Adding `maxspan=5m` and `maxevents=100` caps each transaction's time window and event count, preventing runaway transactions while still allowing duration computation via the transaction's duration field. This directly addresses both the performance concern and the requirement to preserve duration statistics.

Answer

Set `maxpause=1m` to break large transactions by gaps

Answer

Exclude service accounts using `where user_id!="svc*"` before transaction

Answer

Switch to `stats values(_raw) by user_id` to avoid transaction overhead

Question 3

A Splunk administrator is tuning a dashboard that uses `transaction` to correlate web server events. The dashboard frequently times out. The admin reviews the search and sees `transaction client_ip maxspan=1h maxpause=30m`. The dataset contains about 10 million events per hour. The admin suspects that the transaction is causing the timeout. Which action should they take to improve performance while still achieving the grouping?

Accepted Answer

Replace transaction with streamstats to create a session ID, then use stats to aggregate. The transaction command is memory- and CPU-intensive because it must sort and group events by client_ip across the full time range, and with 10 million events per hour it will spill to disk and time out. Replacing it with streamstats to assign a session ID (using time-based resets) followed by stats aggregation achieves the same session grouping with a streaming, single-pass algorithm that scales linearly. This is the Splunk-recommended pattern for high-volume sessionization.

Answer

Add `maxevents=100` to limit events per transaction

Answer

Reduce maxspan to 15m and maxpause to 5m

Answer

Increase the search job concurrency

Question 4

A security analyst is investigating a series of failed login attempts followed by successful logins from the same IP addresses within short time windows. They want to correlate these events into sessions representing potential brute-force attacks. Which TWO statements accurately describe best practices for using the transaction command in this scenario?

Accepted Answer

Transaction command requires at least one field to group events into sessions.. Option B is correct because the transaction command must be given at least one grouping field (for example, src_ip or user) so it knows which events belong to the same session; without a field or a startswith/endswith boundary, it cannot form meaningful transactions. Option C is correct because transaction supports startswith and endswith arguments that let the analyst define explicit session boundaries, such as startswith="failed login" and endswith="successful login", which is exactly how brute-force sequences can be framed. Option A is wrong because transaction is designed for relatively short, bounded event groupings and is not optimized for very long time ranges over 24 hours; other approaches like stats or streamstats are better there. Option D is wrong because transaction groups events across time using their timestamps and maxspan/maxpause, not only identical timestamps. Option E is wrong because transaction does not automatically deduplicate events; it groups them, and any deduplication would require an explicit command such as dedup.

Answer

Transaction command is optimized for correlating events over very long time ranges (over 24 hours).

Answer

Transaction command can only be used with events that have identical timestamps.

Answer

Transaction command automatically deduplicates events within a transaction.

Question 5

Refer to the exhibit. A security analyst notices that some transactions have a duration greater than 600 seconds even though maxpause is set to 5 minutes (300 seconds). What is the most likely reason?

Accepted Answer

The maxspan setting of 30 minutes allows the total transaction duration to reach up to 1800 seconds.. The `maxspan` parameter in the transaction command sets an upper limit on the total duration of the transaction from the first to the last event, regardless of the `maxpause` setting. With `maxspan=30m` (1800 seconds), a transaction can have a total duration up to 1800 seconds, even if individual gaps between events exceed `maxpause=5m` (300 seconds). The `maxpause` only limits the idle time between consecutive events, not the overall span, so transactions with gaps larger than 300 seconds but within the 1800-second span are still valid.

Answer

The transaction command is including events that are more than 5 minutes apart because the maxpause is ignored when maxspan is set.

Answer

The eventcount field is inflated, causing duration to be calculated incorrectly.

Answer

The duration field represents milliseconds, so 600 seconds is actually 0.6 seconds.

Question 6

Which TWO of the following are limitations of the transaction command in Splunk?

Accepted Answer

It defaults to a maximum of 1000 events per transaction.. The transaction command defaults to a maximum of 1000 events per transaction. If a transaction exceeds this limit, Splunk will close the transaction and start a new one, which can lead to incomplete or unexpected results. This limit can be increased using the maxevents argument, but it is a key constraint to be aware of when correlating large sequences of events.

Answer

It cannot be used inside an eval statement.

Answer

It only works with indexed fields.

Answer

It cannot correlate events from multiple sourcetypes.

Question 7

A Splunk Power User is investigating suspicious activity in the `web` index. They need to identify groups of events that share the same `src_ip` and occur within 2 minutes of each other, but they do not want to group events that are more than 30 seconds apart. Which transaction option and value should they use to limit the maximum time between events in a transaction?

Accepted Answer

maxpause=30s. The maxpause parameter sets the maximum time between consecutive events in a transaction. To ensure events are no more than 30 seconds apart, maxpause=30s is the correct choice. maxspan controls total duration, maxevents limits event count, and startswith defines a starting condition—none of which address the gap between events. This parameter is essential for grouping events that occur in close temporal proximity.

Answer

startswith=src_ip

Answer

maxspan=2m

Answer

maxevents=30

Question 8

A network operations team runs `index=netflow | transaction src_ip maxspan=10m` to group flows from the same source IP into sessions. After reviewing the results, they notice that a single transaction can contain events separated by more than 10 minutes of inactivity. Which transaction parameter should they add to ensure that consecutive events within a transaction are never more than 10 minutes apart?

Accepted Answer

maxpause=10m. The maxpause parameter enforces a maximum time gap between consecutive events in a transaction. When the gap exceeds maxpause, a new transaction starts. This is distinct from maxspan, which limits the overall transaction duration. Adding maxpause=10m ensures that events more than 10 minutes apart are not grouped together, directly fixing the issue of long pauses within a single transaction.

Answer

keepevicted=true

Answer

maxspan=10m

Answer

startswith="src_ip"

Question 9

A Splunk Power User is using the transaction command to group events by `user_id`. They notice that some transactions contain events that are separated by more than 30 minutes, even though they expected transactions to be limited to a 30-minute window. Which transaction parameter should they adjust to enforce a maximum time gap between events in a transaction?

Accepted Answer

maxpause. The maxpause parameter defines the maximum time between consecutive events in a transaction. If the time difference between two events exceeds maxpause, the transaction is split. Setting maxpause=30m ensures that events more than 30 minutes apart are not grouped together. This directly solves the problem of transactions containing events with large time gaps.

Answer

endswith

Answer

maxspan

Answer

startswith

Question 10

An analyst uses the transaction command to group events by `session_id` and includes the `duration` field. They notice that the duration values are in seconds, but they need them in minutes for a report. Which SPL command should they use to convert the duration field from seconds to minutes?

Accepted Answer

eval duration_minutes = duration / 60. The eval command is used for calculations and field manipulation in SPL. To convert seconds to minutes, divide the duration field by 60. This creates a new field or overwrites the existing one. The other commands do not perform arithmetic: convert changes data types, rex extracts fields, and multiplication would give the wrong result.

Answer

convert duration / 60

Answer

eval duration = duration * 60

Answer

rex field=duration "(?<minutes>\d+)"

Question 11

A Splunk Power User is investigating a series of failed login attempts followed by a successful login from the same user. They want to create a transaction that groups all events for a user within a 5-minute window, but only if the transaction contains at least one failed login and one successful login. Which transaction parameter should they use to ensure the transaction only includes events that meet this condition?

Accepted Answer

There is no single transaction parameter to enforce this; a subsearch or additional filtering with `search` is required.. The transaction command groups events but does not filter based on the presence of specific events. To require that a transaction contains both failed and successful logins, you must use additional search commands after the transaction, such as filtering with `search` or using `stats` to count event types. Therefore, no single transaction parameter can enforce this condition.

Answer

maxspan=5m

Answer

startswith="failed"

Answer

maxpause=5m

Question 12

A network operations team wants to correlate firewall events into sessions based on a `flow_id` field. They want to limit each transaction to a maximum of 20 events and ensure that transactions are not created if the events span more than 10 minutes. Which transaction options should be used together?

Accepted Answer

maxevents=20 maxspan=10m. To limit a transaction to a maximum number of events, use maxevents. To constrain the total elapsed time between the first and last event of a transaction, use maxspan. Together they enforce both the 20-event cap and the 10-minute duration cap. maxpause controls gaps between consecutive events, maxopenevents controls concurrency, and keepevicted retains otherwise discarded transactions.

Answer

maxevents=20 keepevicted=true

Answer

maxevents=20 maxpause=10m

Answer

maxopenevents=20 maxspan=10m

Question 13

An analyst uses `transaction session_id maxpause=30m` to group web session events. They notice that some transactions contain events from two different users because the session_id field was reused after a logout. Which approach best prevents events from different users being merged into the same transaction?

Accepted Answer

Add the user field to the transaction command so events are grouped by both session_id and user.. The transaction command groups events by the fields specified. When a session_id is reused across users, grouping only by session_id merges unrelated events. Adding the user field to the transaction command creates a composite key of session_id and user, ensuring that events from different users are never combined. Adjusting pause or boundary options does not change the grouping key and therefore does not solve the underlying issue.

Answer

Add keepevicted=true so that transactions with mixed users are retained and can be filtered later.

Answer

Use the startswith option to begin a new transaction whenever a login event is seen.

Answer

Reduce maxpause to 5m so that transactions close sooner and are less likely to include multiple users.

Question 14

A Splunk Power User needs to correlate events from two different sourcetypes: `web` and `auth`. The events share a common field `session_id`. The analyst wants to create transactions that include events from both sourcetypes, but only if the transaction contains at least one event from each sourcetype. Which transaction option should they use?

Accepted Answer

There is no direct transaction option to require multiple sourcetypes; the analyst should use a subsearch or stats to filter.. The transaction command lacks a parameter to enforce the presence of multiple sourcetypes. To correlate events from different sourcetypes and require both, the analyst must use additional SPL, such as a subsearch to filter session_ids that appear in both sourcetypes, or use stats with values(sourcetype) and filter for two distinct values. This is a common pattern for multi-source correlation.

Answer

endswith

Answer

startswith

Answer

maxevents

Question 15

An analyst wants to correlate events from a firewall log where each session is identified by a `src_ip` and `dest_ip` pair. The events include a `bytes` field. The analyst needs to calculate the total bytes transferred per session. Which SPL search accomplishes this?

Accepted Answer

index=firewall | stats sum(bytes) by src_ip, dest_ip. To calculate total bytes per session defined by src_ip and dest_ip, the most straightforward and correct approach is to use the stats command with sum(bytes) grouped by src_ip and dest_ip. This aggregates the bytes field across all events for each unique session without the overhead of the transaction command. The transaction command is unnecessary here because the session identity is already captured by the field pair.

Answer

index=firewall | transaction src_ip dest_ip | stats sum(bytes) by src_ip, dest_ip

Answer

index=firewall | transaction src_ip dest_ip | eval total_bytes = sum(bytes)

Answer

index=firewall | transaction src_ip dest_ip | stats sum(bytes) by transaction_id