SPLK-1002 Transactions and Event Correlation Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. The eval command combines two fields into one. What is a potential issue with this search?

Accepted Answer

If an event has both sessionid and correlation_id, the coalesce may create a new value that does not match other events.. The `coalesce` function returns the first non-null value among its arguments, so if an event has both `sessionid` and `correlation_id`, coalesce picks `sessionid` and ignores `correlation_id` — but other events in the same transaction may only have `correlation_id`, producing a different coalesced value and breaking the transaction grouping. This inconsistency is the core issue with combining fields via coalesce before `transaction`.

Answer

The eval command may cause syntax errors.

Answer

Transaction does not allow eval before it.

Answer

The maxspan should be after the transaction command.

Question 2

Refer to the exhibit. The search returns only transactions that ended with successful login. The administrator wants to see all failed login attempts that did not lead to a success. What is the most efficient approach?

Accepted Answer

Remove the final search command and instead filter on closed_txn=0.. The original search includes a final search command that filters for successful logins. To see all failed login attempts that did not lead to a success, you need to capture evicted transactions (those that closed without success). The most efficient way is to remove the final search command and filter on closed_txn=0. Option A is incorrect because replacing the search with where closed_txn=0 without removing the final filter would still filter out evicted transactions. Option B is incorrect because increasing maxpause may still not capture all failures and could delay results. Option D is incorrect because removing keepevicted=true would discard the evicted transactions, which are exactly the failures you want to see.

Answer

Replace the search with | where closed_txn=0.

Answer

Increase maxpause to 30m.

Answer

Remove the keepevicted=true option.

Question 3

When using the transaction command to group events, which field is automatically added to the event to indicate the start time of the transaction?

Accepted Answer

_time. The transaction command automatically adds a field called duration to each transaction, but it does not add a field for the start time. Instead, the start time of the transaction is represented by the _time field of the first event in the transaction. Since _time is already present on every event, the transaction command does not create a new field for start time; it simply uses the _time of the earliest event as the transaction's start time. Therefore, the field that indicates the start time is _time.

Answer

duration

Answer

None, the transaction command does not add such a field.

Answer

_starttime

Question 4

Consider the following search: 'index=web | transaction sessionid maxspan=30m | where eventcount > 5 | stats avg(duration)'. An analyst notices that the search takes a long time and uses excessive memory. Which change would most likely improve performance?

Accepted Answer

Use the stats command with values(sessionid) instead of transaction.. The transaction command is memory- and CPU-intensive because it must group events by sessionid across the full result set before downstream commands run. Replacing it with 'stats' (e.g., grouping by sessionid and computing count/duration) lets Splunk perform the aggregation in the search pipeline without materializing transaction groups, dramatically reducing memory and runtime.

Answer

Change maxspan to 1h to allow more events.

Answer

Remove the where clause and use stats after transaction.

Answer

Add a filter before transaction to reduce events.

Question 5

Which THREE of the following are valid ways to correlate events in Splunk? (Select exactly 3 correct answers.)

Accepted Answer

Using the join command with a common field.. Option B is correct because the join command correlates events from a main search with events from a subsearch by matching a common field, combining them into single result rows. Option D is correct because stats with values() groups events by a common field and aggregates related values into a single row, effectively correlating events that share that field. Option E is correct because the transaction command groups related events into transactions based on a common field (or fields), which is a core Splunk method for event correlation. Option A is not correct because subsearch is a technique for passing results from one search into another, not a correlation command itself. Option C is not correct because append merely adds the results of a subsearch to the current results without correlating them by any common field.

Answer

Using the subsearch command.

Answer

Using the append command.

Question 6

Refer to the exhibit. An analyst sees that the transaction for sessionid 'abc123' has duration 120 seconds and 4 events. The events within this transaction occur at 10:00:00, 10:01:00, 10:02:00, and 10:03:00. Why did the transaction close?

Accepted Answer

The maxpause of 5 minutes was exceeded; there was no event after 10:03:00 for more than 5 minutes.. The transaction closed because the maxpause constraint was violated. In Splunk transaction searches, maxpause specifies the maximum time allowed between events in a transaction. Here, the events occur at 10:00:00, 10:01:00, 10:02:00, and 10:03:00, with gaps of 60 seconds between each. After the last event at 10:03:00, no further event occurred for more than 5 minutes (300 seconds), so the transaction was closed due to exceeding the maxpause limit. The duration of 120 seconds is simply the time from the first to the last event, which is within any maxspan limit.

Answer

The transaction closed because there were only 4 events.

Answer

The transaction closed because the maxopentxn limit was reached.

Answer

The maxspan of 10 minutes was reached.

Question 7

A security analyst wants to group all authentication events (e.g., login, logout, failure) that occur within a 10-minute window for each user. The events are from multiple sources and share a common 'user' field. Which transaction command is most appropriate?

Accepted Answer

... | transaction user maxspan=600. The transaction command groups events that are related by a common field (user) and constrains the group by a maximum time span. maxspan=600 specifies a 10-minute window (600 seconds), which exactly matches the requirement to group all authentication events within that window. Without startswith/endswith or maxpause, it will group all events for the same user that occur within 600 seconds of the first event, regardless of event type.

Answer

... | transaction user maxspan=600 maxevents=100

Answer

... | transaction user maxpause=120

Answer

... | transaction user maxspan=600 startswith="login" endswith="logout"

Question 8

A Splunk admin notices that a transaction search using the transaction command takes a long time and consumes high memory. The search correlates events by a high-cardinality field (IP address) across multiple indexers. Which optimization technique should be applied first?

Accepted Answer

Increase maxevents to capture more events per transaction.. The correct optimization technique is to increase maxevents, which allows the transaction command to capture more events per transaction, reducing the number of incomplete transactions and improving performance. The fields command reduces data but does not directly address transaction boundaries. The keepevicted option retains incomplete transactions without optimizing performance. The local parameter limits parallelism, increasing time and memory usage on a single indexer.

Answer

Use the fields command to remove unnecessary fields before the transaction.

Answer

Use the keepevicted option to retain incomplete transactions.

Answer

Use the local parameter to force local processing.

Question 9

An analyst wants to correlate events from multiple sourcetypes that have different timestamps but share a common reference ID. The events are ingested with some delay. Which parameter is crucial to ensure the transaction captures all related events despite ingestion delay?

Accepted Answer

maxspan. The maxspan parameter defines the maximum total time span of a transaction, from the first event to the last. When events are ingested with delay, their timestamps may be spread out, but maxspan ensures that all related events within the specified duration are captured, even if they arrive later. This is crucial for correlating events that share a common reference ID but have different timestamps.

Answer

maxpause

Answer

maxevents

Answer

fields _indextime

Question 10

A transaction search is processing too many fields. Which command should be used immediately before the transaction command to reduce memory usage?

Accepted Answer

fields user_id, _time. The 'fields' command with a positive list (without '+' or '-') sets the field list to exactly those specified, keeping only user_id and _time. This reduces memory usage significantly before the transaction command, which typically needs _time and a grouping field like user_id. Option A is incorrect because removing _raw and _time but keeping other fields does not sufficiently reduce fields; transaction requires _time. Option B is incorrect because 'fields +' adds fields to the existing set, not replacing them, so it does not reduce memory. Option C is incorrect because 'fields - * except user_id' removes all fields except user_id, but also removes _time, which is essential for the transaction command to correlate events based on time.

Answer

fields - _raw, _time

Answer

fields + user_id, _time

Answer

fields - * except user_id

Question 11

A Splunk admin wants to group events that share a common `session_id` field. Events arrive out of order. Which transaction field will automatically sort events correctly?

Accepted Answer

transaction automatically sorts by time. `transaction` automatically sorts events by time within each transaction. Option A (sort) is not a transaction option. Option B (index order) is not guaranteed. Option D (timeordered) is not a valid option.

Answer

sort=_time

Answer

Use option `timeordered=true`

Answer

No sorting needed; events are indexed in order

Question 12

A search includes `... | transaction 1,2,3` but returns unexpected results. What does the `1,2,3` represent in this context?

Accepted Answer

maxspan=1s, maxpause=2s, maxevents=3. When the `transaction` command is given three numeric arguments without field names, they are interpreted as `maxspan`, `maxpause`, and `maxevents` respectively. Therefore, `1,2,3` means maxspan=1 second, maxpause=2 seconds, and maxevents=3. Option A is wrong because these are not field names; transaction keys are specified by providing field names as arguments. Option B is wrong because transaction does not correlate across indexes; it groups events based on fields or time. Option C is wrong because these are not status codes; transaction uses temporal settings and event count limits.

Answer

Field names to use as transaction keys

Answer

Three index names to correlate across indexes

Answer

Status codes for transactions (1=open, 2=pending, 3=closed)

Question 13

An analyst runs `sourcetype=access_combined | transaction clientip` and notices many single-event transactions. Which option would help close transactions more accurately?

Accepted Answer

Add `endswith="status=200"`. The `transaction` command groups events by a field (clientip) and creates transactions based on start and end conditions. By default, it uses a maxpause of 30 minutes and maxspan of 1 hour, but without explicit end conditions, it may close transactions prematurely or create many single-event transactions. Adding `endswith="status=200"` provides a clear end condition, so transactions close when a 200 status is seen, reducing single-event transactions. This makes the transaction boundaries more accurate.

Answer

Increase maxpause to 1 hour

Answer

Do nothing; single events are fine

Answer

Set closedelay=10

Question 14

Which TWO options are valid parameters of the `transaction` command?

Accepted Answer

maxpause. The `transaction` command in Splunk accepts `maxpause` (B), which sets the maximum time span in seconds between events for them to still be grouped into the same transaction — if the gap exceeds this value, a new transaction begins. It also accepts `keepevicted` (D), which retains evicted (incomplete) transactions in the results instead of discarding them, useful when you want to see transactions that never closed. Options A (`timeformat`), C (`sequential`), and E (`fieldlist`) are not valid `transaction` parameters — `timeformat` belongs to commands like `convert`/`eval`/`strptime`, `sequential` is a `transaction` argument only as `maxspan`-style constraints are not named that way (the actual constraint is `maxspan`/`maxpause`/`maxevents`), and `fieldlist` is a parameter of commands such as `table` or `stats`, not `transaction`.

Answer

timeformat

Answer

sequential

Answer

fieldlist

Question 15

Which TWO conditions can cause a transaction to be evicted?

Accepted Answer

Maximum pause between events exceeded. In Splunk, a transaction is bounded by constraints that can cause it to be evicted from memory before being finalized. Option A (Maximum pause between events exceeded) is correct because the maxpause setting closes a transaction when the gap between consecutive events exceeds the specified duration, evicting the transaction. Option C (Maximum number of events per transaction reached) is correct because the maxevents setting caps how many events a transaction can contain, and once that limit is hit the transaction is evicted. Option B is incorrect because timestamp format mismatches affect event parsing, not transaction eviction. Option D is incorrect because field count is not a transaction eviction condition. Option E is incorrect because a user canceling a search stops the search but is not a transaction eviction condition.

Answer

Timestamp format mismatch

Answer

Transaction has too many fields

Answer

Search is canceled by user