SPLK-1002 Transactions and Event Correlation Practice Test 5 — 15 Questions

Question 1

Refer to the exhibit. The search returns only transactions that ended with successful login. The administrator wants to see all failed login attempts that did not lead to a success. What is the most efficient approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Remove the final search command and instead filter on closed_txn=0.. The original search includes a final search command that filters for successful logins. To see all failed login attempts that did not lead to a success, you need to capture evicted transactions (those that closed without success). The most efficient way is to remove the final search command and filter on closed_txn=0. Option A is incorrect because replacing the search with where closed_txn=0 without removing the final filter would still filter out evicted transactions. Option B is incorrect because increasing maxpause may still not capture all failures and could delay results. Option D is incorrect because removing keepevicted=true would discard the evicted transactions, which are exactly the failures you want to see.

Answer

Replace the search with | where closed_txn=0.

Answer

Increase maxpause to 30m.

Answer

Remove the keepevicted=true option.

Question 2

A security analyst wants to group all events from a single web session into one transaction. The session is identified by a 'sessionId' field, and events are generated over a period that can last up to 30 minutes. The analyst also wants to close the transaction if there is no activity for more than 10 minutes. Which transaction parameters should be used?

Accepted Answer

maxspan=30m, maxpause=10m. The maxspan parameter sets the maximum total duration of the transaction, while maxpause sets the inactivity timeout. Option D correctly specifies maxspan=30m (to cover the maximum session length) and maxpause=10m (to close the transaction after 10 minutes of inactivity).

Answer

maxspan=30m, maxpause=5m

Answer

maxspan=10m, maxpause=30m

Answer

maxspan=1h, maxpause=10m

Question 3

A search using the transaction command is producing many partial transactions that are closed due to maxpause, but these transactions are often relevant and should not be discarded. Which option should be added to the transaction command to keep these partial results?

Accepted Answer

keepevicted=true. The keepevicted=true option retains transactions that are closed due to maxpause (i.e., evicted transactions). This ensures that partial but potentially relevant transactions are not discarded and appear in the results. The closed=true option is not a valid parameter for the transaction command.

Answer

keepopen=true

Answer

closed=true

Answer

partial=true

Question 4

A Splunk Power User needs to find the average duration of user sessions. The sessions are defined by a 'user_id' field and have a max inactivity of 15 minutes. Which search correctly calculates this?

Accepted Answer

index=main | transaction user_id maxpause=15m | stats avg(duration). The transaction command with maxpause=15m groups events by user_id and adds a duration field. The stats command then calculates the average duration.

Answer

index=main | transaction user_id maxpause=15m | eval avg=avg(duration)

Answer

index=main | transaction user_id maxpause=15 | stats avg(_time)

Answer

index=main | transaction user_id maxspan=15m | stats avg(duration)

Question 5

Consider the following search: 'index=web | transaction sessionid maxspan=30m | where eventcount > 5 | stats avg(duration)'. An analyst notices that the search takes a long time and uses excessive memory. Which change would most likely improve performance?

Accepted Answer

Use the stats command with values(sessionid) instead of transaction.. Using the stats command with values(sessionid) replaces the resource-intensive transaction command. The transaction command buffers all events belonging to the same session within the maxspan window, consuming memory and CPU. The stats command processes events in a more efficient streaming manner, reducing resource usage. Moreover, by using stats, the search can directly aggregate events by sessionid without requiring a maxspan window or a subsequent where clause, thereby improving performance.

Answer

Change maxspan to 1h to allow more events.

Answer

Remove the where clause and use stats after transaction.

Answer

Add a filter before transaction to reduce events.

Question 6

A Splunk search uses 'transaction clientip maxpause=5m'. What does the maxpause setting control?

Accepted Answer

The maximum time gap between events in the transaction.. maxpause sets the maximum inactivity timeout: if no new event for the same clientip arrives within 5 minutes, the transaction is closed.

Answer

The maximum number of transactions allowed.

Answer

The maximum number of events in the transaction.

Answer

The maximum total time span of the transaction.

Question 7

An analyst wants to group events from different sourcetypes (web_access and error_log) into a single transaction when they share the same 'request_id' field and occur within 1 minute. Which search correctly accomplishes this?

Accepted Answer

(sourcetype=web_access OR sourcetype=error_log) | transaction request_id maxspan=1m. Using OR to combine sourcetypes and then transaction with maxspan=1m groups events by request_id across both sourcetypes, with a total time limit of 1 minute.

Answer

index=* | transaction request_id maxspan=1m

Answer

index=main | join type=inner request_id [search sourcetype=error_log]

Answer

sourcetype=web_access | transaction request_id maxspan=1m | append [search sourcetype=error_log | transaction request_id maxspan=1m]

Question 8

A search includes 'transaction userid maxspan=1h maxopentxn=1000'. What is the purpose of maxopentxn?

Accepted Answer

It limits the number of transactions that can be open simultaneously in memory.. The `maxopentxn` parameter in the `transaction` command limits the number of transactions that can be open at the same time in memory. Once this limit is reached, the transaction with the longest idle time is closed forcefully. This prevents excessive memory usage when many transactions are in progress. It does not directly limit the total number of transactions in the final results, nor does it limit events per transaction or time span of open transactions.

Answer

It limits the total number of transactions in the search results.

Answer

It limits the number of events per transaction.

Answer

It limits the time span of open transactions.

Question 9

Which TWO fields are automatically created by the transaction command? (Select exactly 2 correct answers.)

Accepted Answer

_endtime. The transaction command adds _starttime and _endtime fields to each event in the transaction. It also adds duration and eventcount, but those are not listed as options. _time and maxpause are not created by transaction.

Answer

total_events

Answer

_time

Answer

maxpause

Question 10

Which THREE of the following are valid ways to correlate events in Splunk? (Select exactly 3 correct answers.)

Accepted Answer

Using the join command with a common field.. Transaction groups events based on common fields. Join can correlate events from two searches. Stats with values can also correlate by grouping events into a single result. Append and subsearch do not perform correlation.

Answer

Using the subsearch command.

Answer

Using the append command.

Question 11

Which THREE strategies can help reduce memory usage when using the transaction command? (Select exactly 3 correct answers.)

Accepted Answer

Filter events before the transaction command.. Reducing maxspan and maxpause limits the time window, thus fewer open transactions. Filtering events early and using the fields command to limit fields reduce data volume. Increasing maxopentxn and keepevicted=true increase memory usage.

Answer

Use keepevicted=true.

Answer

Increase maxopentxn.

Question 12

Refer to the exhibit. What is the purpose of the 'maxpause=5m' parameter in this search?

Accepted Answer

It closes the transaction if there is no new event from the same clientip within 5 minutes.. maxpause sets the inactivity timeout: if no new event from the same clientip arrives within 5 minutes, the transaction is closed.

Answer

It limits the number of events in a transaction to 5.

Answer

It limits the total time span of each transaction to 5 minutes.

Answer

It pauses the search for 5 minutes between transactions.

Question 13

Refer to the exhibit. What is the purpose of this configuration?

Accepted Answer

It defines a transaction type that can be used in search with `transaction mytransaction` to group events by clientip and userid with given time parameters.. This stanza defines a named transaction type in transaction.conf. It can be invoked in a search as `transaction mytransaction` to group events by clientip and userid with the specified time parameters (maxpause, maxevents).

Answer

It creates a search-time field extraction for clientip and userid.

Answer

It configures the transaction command to run automatically on all data.

Answer

It defines a transaction type that can be used in search with `transaction mytransaction` to group events by clientip and userid, ignoring the specified time parameters.

Question 14

Refer to the exhibit. An analyst sees that the transaction for sessionid 'abc123' has duration 120 seconds and 4 events. The events within this transaction occur at 10:00:00, 10:01:00, 10:02:00, and 10:03:00. Why did the transaction close?

Accepted Answer

The maxpause of 5 minutes was exceeded; there was no event after 10:03:00 for more than 5 minutes.. Since maxpause=5m is specified, the transaction closed 5 minutes after the last event (10:03:00) at approximately 10:08:00, but because maxspan is 10m, the 2-minute duration is well under that. The close was due to the inactivity timeout.

Answer

The transaction closed because there were only 4 events.

Answer

The transaction closed because the maxopentxn limit was reached.

Answer

The maxspan of 10 minutes was reached.

Question 15

A security analyst wants to group all authentication events (e.g., login, logout, failure) that occur within a 10-minute window for each user. The events are from multiple sources and share a common 'user' field. Which transaction command is most appropriate?

Accepted Answer

... | transaction user maxspan=600. 'maxspan=600' limits the transaction time window to 600 seconds (10 minutes), which meets the requirement of grouping events within 10 minutes for each user. There's no need for startswith/endswith as all authentication events should be included. Option A is incorrect because 'maxevents=100' may truncate transactions with more than 100 events. Option B is incorrect because 'maxpause=120' only sets a pause threshold but does not enforce a total time limit; transactions could exceed 10 minutes if events continue with short pauses. Option C is incorrect because using startswith and endswith restricts the transaction to only those that begin with 'login' and end with 'logout', potentially excluding other authentication events like failures.

Answer

... | transaction user maxspan=600 maxevents=100

Answer

... | transaction user maxpause=120

Answer

... | transaction user maxspan=600 startswith="login" endswith="logout"