SPLK-1002 Transactions and Event Correlation Practice Test 4 — 15 Questions

Question 1

Refer to the exhibit. A security analyst runs the above search. Which of the following best describes the result?

Accepted Answer

Transactions beginning with 'allow' and ending with 'deny' for src_ip 10.0.0.1, with a maximum duration of 5 minutes. The search uses transaction with startswith=allow, endswith=deny, maxspan=5m, and filters src_ip=10.0.0.1, so it groups events into transactions that begin with an 'allow' action and end with a 'deny' action for that source IP, with each transaction lasting no more than 5 minutes. The result is exactly those transactions.

Answer

Transactions for all source IPs, but only showing src_ip 10.0.0.1 in the table

Answer

Transactions of all firewall events for src_ip 10.0.0.1, each lasting up to 5 minutes

Answer

Transactions of src_ip 10.0.0.1 that start with deny and end with allow

Question 2

A SOC analyst is investigating a security incident. They use `transaction src_ip` to group firewall events. The search returns too many single-event transactions. The analyst suspects that some events should be grouped but are not because the IP address is used by different sessions. Which option can help ensure events are grouped only if they occur close in time?

Accepted Answer

maxpause=5m. The `maxpause` option in the `transaction` command specifies the maximum time gap allowed between consecutive events within a transaction. If the pause between two events exceeds this value, a new transaction is started. This directly addresses the analyst's problem: events from the same src_ip that are far apart in time will not be grouped together, reducing the number of single-event transactions caused by unrelated sessions. Setting `maxpause=5m` ensures that only events occurring within 5 minutes of each other are grouped into the same transaction.

Answer

maxspan=1h

Answer

maxevents=2

Answer

fields=src_ip

Question 3

A search uses `transaction sessionId` to correlate events. However, the transaction command is consuming too much memory and the search fails. Which approach can reduce memory usage while still approximating the transaction grouping?

Accepted Answer

Use `stats values(_raw) by sessionId`. Using stats values(_raw) by sessionId groups events by sessionId and collects the raw events into a multivalue field, approximating transaction grouping without the memory overhead of transaction's event-boundary tracking. This is the recommended approach when transaction fails due to memory limits.

Answer

Add `maxevents=100` to the transaction

Answer

Use `dedup sessionId`

Answer

Increase the search job memory limit

Question 4

A company has events from multiple data sources that share a common 'request_id'. They want to correlate events from different sources (e.g., web, app, database) into a single transaction per request. However, the timestamps across sources are not synchronized, causing some events to appear out of order. Which approach is best to ensure correct grouping?

Accepted Answer

Use `sort _time | transaction request_id maxspan=10m`. The transaction command groups events sharing a field value (request_id) into a single transaction, and the maxspan parameter defines the maximum time between the first and last event in a transaction. Because timestamps across sources are not synchronized, events may arrive out of order; sorting by _time before transaction ensures Splunk processes events in chronological order, and a generous maxspan (e.g., 10m) accommodates clock skew. This combination produces correct grouping even when source clocks differ.

Answer

Use `eventstats count by request_id` to correlate counts

Answer

Use `transaction request_id` and rely on Splunk to automatically reorder

Answer

Use `transaction request_id maxspan=1m` and ignore out-of-order events

Question 5

A user wants to see a single consolidated event for each user session that includes the start time, end time, and total duration. The session events have a 'action' field with values 'start' and 'end' and a common 'user_id'. Which transaction command would achieve this?

Accepted Answer

`transaction user_id startswith=action=start endswith=action=end`. The transaction command groups events into a single transaction based on a common field (user_id) and optionally defines the boundaries of the transaction using startswith and endswith. In this case, the user wants to group events by user_id and define the transaction boundaries with action=start and action=end. Option A correctly specifies the common field as user_id and uses startswith=action=start and endswith=action=end to define the start and end events. This will produce a single event per user session with start time, end time, and duration (which transaction automatically calculates).

Answer

`transaction startswith=action=start endswith=action=end`

Answer

`transaction user_id`

Answer

`stats values(action) by user_id`

Question 6

A search uses `transaction session_id maxspan=30m` to group events. The search returns 5000 transaction events. The analyst needs to filter out any transaction that does not contain an event with status=failure. Which post-transaction command should be used?

Accepted Answer

`| transaction session_id maxspan=30m | search status=failure`. After a transaction command, the search command can filter transactions based on the presence of a field value within the transaction's events. Because transaction preserves the raw events and their fields, `| search status=failure` returns only transactions that contain at least one event with status=failure.

Answer

`| transaction session_id maxspan=30m | stats count(eval(status="failure")) by session_id`

Answer

`| transaction session_id maxspan=30m | where status=failure`

Answer

`| transaction session_id maxspan=30m | eval has_failure=if(match(_raw, "failure"),1,0) | where has_failure=1`

Question 7

Which TWO options can be used with the `transaction` command to control how many events are included in a single transaction?

Accepted Answer

maxspan. In Splunk's `transaction` command, `maxspan` (option B) is correct because it limits a transaction by elapsed time — e.g., `maxspan=5m` groups events occurring within a 5-minute window, thereby constraining how many events fall into one transaction. `maxevents` (option E) is also correct because it sets a hard cap on the number of events per transaction, e.g., `maxevents=10`, directly controlling the event count. The other options do not serve this purpose: `mvcount` (A) is a field-extraction/`stats`-related setting for multivalue fields, `maxpause` (C) limits the gap between consecutive events rather than the total count, and `keepevicted` (D) only retains evicted (incomplete) transactions for inspection, not the number of events included.

Answer

mvcount

Answer

maxpause

Answer

keepevicted

Question 8

Which THREE statements about the `transaction` command are true?

Accepted Answer

Transaction can correlate events based on more than one field.. Option A is correct because the transaction command accepts multiple field names (e.g., transaction host, user, session_id) and groups events sharing those field values into a single transaction. Option B is correct because when events are merged into a transaction, fields with multiple values across the constituent events are preserved as multivalue fields in the resulting transaction event. Option D is correct because when startswith and endswith are used to define transaction boundaries, Splunk adds a duration field to the transaction event reflecting the elapsed time between the first and last event. Option C is incorrect because maxpause sets the maximum time between consecutive events for them to remain in the same transaction, not the total span; maxspan controls the overall transaction duration. Option E is incorrect because transaction is resource-intensive and generally less efficient than stats or eventstats for grouping large datasets, since it must sort and merge raw events.

Answer

The maxpause option sets the maximum time span of the transaction.

Answer

Transaction is the most efficient way to group events from large datasets.

Question 9

A large e-commerce company is using Splunk to monitor user sessions across multiple microservices. Each service logs events with a common 'session_id' field. The security team wants to identify sessions where a user performed a 'password_change' action followed by a 'login' from a different IP address within 5 minutes, indicating possible account takeover. The current search uses `transaction session_id startswith=action=login endswith=action=password_change maxspan=10m`. However, the search returns very few results, and the team suspects it is missing many attacks. The logs show that sometimes 'password_change' occurs before 'login' (e.g., password reset then login) and the IP changes are observed across multiple events. The team needs to capture both orderings. Which approach should they take?

Accepted Answer

Use `transaction session_id maxspan=5m` and then filter for sessions that contain both actions. The current search only captures one order (login then password_change). To capture both orders, they should either use `transaction session_id maxspan=5m` without startswith/endswith and then filter, or use two separate transactions and combine. The best option is to use `transaction session_id maxspan=5m` and then search for events where both actions occur, because it avoids order dependency and is simpler.

Answer

Use `transaction session_id startswith=action=password_change endswith=action=login maxspan=5m` in a separate search and append results

Answer

Keep the current search but increase maxspan to 30m

Answer

Add both startswith and endswith with OR conditions: `startswith=(action=login OR action=password_change) endswith=(action=login OR action=password_change)`

Question 10

A Splunk administrator at a company with 500 employees needs to correlate VPN login events with subsequent network access logs to track user sessions. The VPN logs contain fields: user, src_ip, timestamp, event_type (login or logout). The network logs contain fields: user, dst_ip, timestamp, action (allow or deny). Both logs are indexed daily. The administrator wants to create a search that groups each VPN login with all network access events from that user within the next 8 hours. However, the current search using `transaction user startswith="login" endswith="logout" maxspan=8h` is returning many incomplete transactions where the logout event is missing. What is the most efficient way to improve the correlation without missing sessions?

Accepted Answer

Use `transaction user startswith="login" endswith="logout" maxspan=8h keepevicted=true`.. Adding keepevicted=true to the transaction command causes Splunk to output incomplete transactions (those missing the logout event) as evicted transactions. This allows the analyst to see all sessions, including those where the logout was not recorded, preventing missing data. Option A uses stats with time buckets, which does not properly group events into sessions. Option B removes startswith and endswith, so it would group all events of the same user within 8 hours, potentially merging separate sessions inaccurately. Option D uses maxevents=100, which may still drop sessions if they have many events, and manual filtering is inefficient.

Answer

Use a different approach: `... | stats values(*) as * by user, time_bucket | ...` with bucket times.

Answer

Change to `transaction user maxspan=8h` and remove startswith/endswith.

Answer

Use `transaction user maxspan=8h maxevents=100` and filter manually.

Question 11

A financial services company uses Splunk to monitor transactions between internal systems. Each transaction consists of a request event and a response event with identical fields: transaction_id, timestamp, component, status. The request event has component='app' and status='request'; the response event has component='db' and status='success' or 'failure'. The analyst runs the following search to correlate them: `index=main (component=app OR component=db) | transaction transaction_id maxspan=30s`. However, they notice that the search takes too long and often times out when there are many transactions. What change would most effectively reduce search time while still correctly grouping request-response pairs?

Accepted Answer

Use `transaction transaction_id maxevents=2 maxspan=30s`.. Using `transaction` with `maxevents=2` limits the number of events grouped per transaction, reducing memory and processing overhead. Since each transaction consists of exactly two events (request and response), this constraint efficiently groups them without scanning for additional events, thus speeding up the search while maintaining correct pairing.

Answer

Use `transaction transaction_id maxspan=30s` with a time range picker to limit the search to a smaller time window.

Answer

Use `stats values(*) as * by transaction_id` and then filter.

Answer

Use `rename component to type` and then use `transaction`.

Question 12

A large e-commerce site logs all user page views and purchases. Each event contains user_id, session_id, timestamp, and event_type (view or purchase). The marketing team wants to analyze the sequence of views that lead to a purchase. They use `transaction session_id startswith="view" endswith="purchase" maxspan=1h`. However, they find that some transactions are missing purchase events because the purchase occurs after 1 hour, or sometimes multiple purchases occur within the same session. To include all related events and correctly identify the sequence leading to each purchase, what is the best approach?

Accepted Answer

Use `stats list(event_type) by session_id` with time sorting to reconstruct the sequence.. The transaction command with startswith/endswith and maxspan is limited: it groups events into transactions based on the boundaries and time window, so purchases occurring after maxspan or multiple purchases in one session are not correctly captured. Using stats with list(event_type) by session_id and sorting by time reconstructs the full ordered sequence of events per session, allowing the marketing team to see all views and purchases without the constraints of transaction boundaries. This approach captures all related events and correctly identifies the sequence leading to each purchase.

Answer

Use `transaction session_id startswith="view" endswith="purchase" maxspan=1h keepevicted=true` to see partial sequences.

Answer

Increase maxspan to 24h to capture all potential purchases.

Answer

Use `transaction user_id maxspan=1h` without startswith/endswith to group all events.

Question 13

A telecom company monitors call detail records (CDR). Each call has a unique call_id, and events are generated at each network node (setup, ringing, answer, hangup) with timestamps. The events are from different sourcetypes (cdr_setup, cdr_ring, etc.) and are indexed in near real-time. The analyst needs to correlate all events for the same call_id to calculate call duration. The current search is: `index=telecom sourcetype=cdr_* | transaction call_id maxspan=2h`. This search works but sometimes produces huge transactions (100+ events) due to noisy data, causing memory errors. The analyst has identified that each call should have exactly 4 events: setup, ringing, answer, hangup. Which approach would best correlation with minimal resource usage?

Accepted Answer

Use `transaction call_id maxevents=4 maxspan=2h` to limit to exactly 4 events.. `maxevents=4` directly limits the transaction to exactly four events per call_id, preventing memory errors from noisy data while ensuring each transaction contains the expected setup, ringing, answer, and hangup events. This constraint is applied during the transaction command itself, reducing resource usage by discarding oversized groups immediately rather than post-processing.

Answer

Use `transaction call_id maxspan=2h` and then filter using `where mvcount(_raw) = 4`.

Answer

Use `eventstats count by call_id` and then filter.

Answer

Use `search` with `call_id=*` and then use `streamstats` to calculate duration per call.

Question 14

A security operations center (SOC) uses Splunk to correlate alerts from multiple sources. They have a rule that triggers a transaction when an IDS alert is followed within 5 minutes by a firewall deny event from the same source IP. The search is: `index=security sourcetype=ids OR sourcetype=firewall | transaction src_ip startswith="ids" endswith="firewall" maxspan=5m`. This works well when the deny event occurs after the alert. However, analysts are missing correlations where the firewall deny event occurs slightly before the IDS alert (up to 1 minute before). To capture these out-of-order events without significantly increasing resource usage, what should the analyst do?

Accepted Answer

Use `transaction src_ip maxspan=6m` without startswith/endswith and then filter for events with both sourcetypes.. Using `transaction src_ip maxspan=6m` without `startswith` and `endswith` groups all events from the same source IP within 6 minutes. This captures the pair regardless of order (IDS alert before firewall or firewall before IDS). A subsequent filter for events with both sourcetypes isolates the desired pair. This approach does not significantly increase resource usage because the `maxspan` limits the time window. Option B fails because `transaction` still requires the `startswith` event to occur before the `endswith` event; if the firewall deny comes first, the IDS alert is not the start, so no transaction is created. Option A (`reverse`) has no effect as `transaction` internally sorts events by time. Option C (`sort` and `eventstats`) does not group events into transactions, making it unsuitable for correlation.

Answer

Use `reverse` before transaction to process events in reverse time order.

Answer

Increase maxspan to 6 minutes and add `maxevents=2`.

Answer

Use `sort` with time dimension and then use `eventstats` to mark pairs.

Question 15

A large enterprise runs Splunk Enterprise with 500 servers forwarding Windows security logs. The security team wants to correlate failed logins (EventCode 4625) with subsequent successful logins (EventCode 4624) from the same source IP within a 5-minute window. They currently use the following search: index=windows sourcetype=WinEventLog:Security (EventCode=4625 OR EventCode=4624) | transaction src_ip maxpause=5m | search EventCode=4625 AND EventCode=4624. This search is extremely slow and often times out. Which approach would improve performance while maintaining the same correlation logic?

Accepted Answer

Replace transaction with a combination of stats and where that groups by src_ip and then filters for pairs.. Replacing the transaction command with stats and where is the recommended approach because transaction is memory-intensive and does not scale well with large event volumes. Using stats to group by src_ip and then filtering for the presence of both EventCode 4625 and 4624 within a 5-minute window achieves the same correlation logic with far better performance.

Answer

Use the append command to combine the two event types after separate searches.

Answer

Add maxevents=1000 to the transaction command to limit event count.

Answer

Increase maxpause to 10 minutes to allow more events per transaction.