SPLK-1002 Transactions and Event Correlation Practice Test 5 — 15 Questions

Question 1

A security analyst needs to group all events that share the same value of the field `src_ip` into a single transaction, but the events are not guaranteed to be in chronological order. Which transaction option should the analyst use to ensure events are sorted by time before grouping?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

sort. The transaction command groups events by a common field, and by default it sorts events by time before grouping. The sort option explicitly controls this behavior. Using sort=true ensures that events are ordered chronologically, which is important for correct transaction duration and event sequence. The other options do not control sorting.

Answer

keepsort

Answer

maxpause

Answer

mvlist

Question 2

A security analyst needs to correlate events from multiple sources into transactions based on a common field 'correlation_id'. The events may arrive out of order and some transactions may be incomplete. The analyst wants to ensure that transactions are correctly formed even when events are not sorted by time. Which two actions should the analyst take? (Choose two.)

Accepted Answer

Use the `sort` command before `transaction` to order events by _time and correlation_id.. To correctly form transactions from out-of-order events, sorting by time before the transaction command is essential. Additionally, enabling keepevicted=true ensures that incomplete transactions are not discarded, which is important when some transactions lack a clear end. These two actions together address the challenges of out-of-order events and incomplete transactions.

Answer

Use `mvlist=true` to preserve the order of multivalue fields within transactions.

Answer

Add `startswith="correlation_id"` to ensure each transaction begins with an event containing correlation_id.

Answer

Use `maxspan=0` to allow transactions of unlimited duration.

Question 3

A security analyst needs to correlate VPN connection events for the same user into sessions. The events have `user` and `action` fields (values `connect` or `disconnect`). The analyst wants each transaction to include only the initial connect event and the next disconnect event for that user, and to avoid grouping unrelated sessions that occur hours apart. Which SPL search best accomplishes this?

Accepted Answer

index=vpn | transaction user startswith=action="connect" endswith=action="disconnect" maxspan=1h. The correct search uses startswith and endswith to define the transaction boundaries based on the action field, ensuring each transaction contains a connect followed by a disconnect. The maxspan=1h parameter sets an upper limit on the total time from the first to the last event, which prevents grouping sessions that are separated by long periods. This combination precisely meets the analyst's need to correlate only related VPN sessions.

Answer

index=vpn | transaction user maxpause=1h

Answer

index=vpn | transaction user startswith=action="connect" endswith=action="disconnect" maxevents=2

Answer

index=vpn | transaction user startswith=action="connect" endswith=action="disconnect" maxpause=1h

Question 4

A Splunk Power User is correlating order-processing events in the retail index. Each order emits a 'start' event and a 'complete' event that share an 'order_id' field, but some orders never receive a 'complete' event. The analyst wants the search to return only orders that have BOTH a start and a complete event. Which transaction option should be added to `transaction order_id` to accomplish this?

Accepted Answer

startswith="start" endswith="complete". The transaction command can require specific boundary events using startswith and endswith. When both are supplied, a transaction is only emitted if it opens with the named start event and closes with the named end event. Orders lacking a complete event therefore drop out, so the search returns only fully completed orders and eliminates the incomplete ones the analyst wants to exclude.

Answer

keptevents=t

Answer

connected=t

Answer

mvlist=t

Question 5

A fraud analyst wants to correlate credit card authorization and settlement events. Each event contains a `txn_id` field and a `status` field with values `auth` or `settle`. The analyst needs transactions that begin with an authorization and end with a settlement, and must discard any transaction missing either. Which search accomplishes this?

Accepted Answer

`index=payments | transaction txn_id startswith="auth" endswith="settle"`. The `transaction` command can enforce which events open and close a group by using `startswith` and `endswith` with a field and value. Here, `startswith="auth"` and `endswith="settle"` ensure each emitted transaction contains an authorization as its first event and a settlement as its last. Groups lacking either boundary event are not returned, which exactly matches the analyst's requirement.

Answer

`index=payments | transaction txn_id maxspan=1h`

Answer

`index=payments | transaction txn_id mvlist=true`

Answer

`index=payments | transaction txn_id keepevicted=true`

Question 6

A Splunk Power User is using the transaction command to group events by `user_id` and wants to reduce memory usage. Which TWO actions should they take? (Choose two.)

Accepted Answer

Use the `maxpause` parameter to limit the time between events.. To reduce memory usage when using transaction, limit the size of transactions. maxspan caps the total duration, and maxpause caps the time between events. Both reduce the number of events per transaction. Avoiding mvlist also helps, but it is not listed as a correct option. The other options either increase memory or are invalid.

Answer

Use the `mvlist` parameter to include all events in the transaction output.

Answer

Use the `keepevicted` parameter to retain evicted events.

Answer

Use the `sort` parameter set to false to avoid sorting events.

Question 7

A Splunk Power User is using the `transaction` command to group web access events by `session_id`. The search is running slowly and consuming significant memory. The user wants to reduce memory usage without losing important transactions. Which two actions should the user take? (Choose two.)

Accepted Answer

Add a `maxevents` parameter to limit the number of events per transaction.. The transaction command can consume large amounts of memory because it holds events for open transactions. Adding maxspan limits the total time window for a transaction, reducing the number of events that can be grouped. Adding maxevents caps the number of events per transaction, directly limiting memory per transaction. Both parameters help bound resource usage without discarding the transaction functionality.

Answer

Remove the `session_id` grouping and use `stats` instead.

Answer

Increase the `maxopenevents` setting in limits.conf.

Answer

Use `maxpause` instead of `maxspan` to limit the time between events.

Question 8

A Splunk administrator needs to correlate events from a custom application that logs a 'start' event and an 'end' event for each job. The events are in the same index and sourcetype but do not have a common job identifier field. However, the start event always immediately precedes the end event for the same job. Which transaction parameter should be used to group these events into transactions?

Accepted Answer

There is no reliable way to group these events using transaction without a common field; an alternative approach is needed.. The transaction command requires a common field to group related events. Without a job identifier, it cannot reliably pair start and end events, especially if multiple jobs run concurrently. Timing parameters like maxpause or maxspan can help but are not guaranteed to correctly associate events. Therefore, an alternative method such as using streamstats to identify consecutive start and end events is necessary.

Answer

startswith="start" endswith="end"

Answer

maxspan=1s

Answer

maxpause=1s

Question 9

A network operations team correlates firewall sessions using `transaction src_ip dst_ip` with `maxpause=30s`. During peak traffic, searches fail with the message that the transaction command exceeded its memory limit. The team cannot increase server memory. Which change is most likely to let the search complete while preserving the same transaction grouping?

Accepted Answer

Add `maxspan=5m` and `mvlist=false` to limit group size and stop retaining multivalue fields.. The transaction command's memory use grows with the number and size of open groups. Adding `maxspan` forces groups to close after a bounded time, and `mvlist=false` prevents retaining per-field multivalue lists inside each transaction. These settings reduce peak memory while keeping the same `src_ip`/`dst_ip` grouping and the 30-second pause logic intact, so sessions that legitimately complete within the span are still correlated correctly.

Answer

Replace `transaction src_ip dst_ip` with `stats` using `min(_time)` and `max(_time)` grouped by `src_ip` and `dst_ip`.

Answer

Add a `dedup` command immediately after the transaction to remove duplicates.

Answer

Add `maxopenevents` with a low value to cap the number of events held open.

Question 10

A network operations team ingests firewall logs where each connection emits a 'connect' event and, later, a 'disconnect' event keyed on 'conn_id'. Some connections are long-lived, with hours between the two events, and the team wants each connection's events grouped into a single transaction regardless of that gap. Which transaction configuration best achieves this?

Accepted Answer

transaction conn_id maxspan=24h. The transaction command limits grouping by time through maxspan, the maximum total duration of a transaction. Because the connection events can be hours apart, a generous maxspan such as twenty-four hours is required so the connect and disconnect events for one conn_id remain in a single transaction. Options that constrain or ignore the time window would break long-lived connections apart.

Answer

transaction conn_id mvlist=t

Answer

transaction conn_id maxspan=0

Answer

transaction conn_id maxpause=1h

Question 11

A network operations team ingests DHCP lease events into the `netops` index. Each lease event contains `client_mac`, `assigned_ip`, and a `lease_state` field whose value is either `BOUND` or `RELEASED`. The team wants to pair each BOUND event with the matching RELEASED event for the same `client_mac`, and they only want results where both events are present. Which search accomplishes this?

Accepted Answer

index=netops | transaction client_mac startswith="lease_state=BOUND" endswith="lease_state=RELEASED". Pairing a BOUND event with a matching RELEASED event for the same client requires grouping by the shared identifier and enforcing both a start and end condition. The transaction command with startswith and endswith does exactly that, and it discards incomplete groups, so only lease cycles that contain both boundary events are returned.

Answer

index=netops | stats values(assigned_ip) BY client_mac | where mvcount(assigned_ip) > 0

Answer

index=netops lease_state=BOUND OR lease_state=RELEASED | join client_mac [search index=netops lease_state=RELEASED]

Answer

index=netops | stats count BY client_mac, lease_state | where count=2

Question 12

A Power User needs to count how many distinct purchase flows occurred in the ecommerce index during the last day. Each flow consists of a cart event, a checkout event, and a payment event that all share a 'flow_id' value. Which search returns the number of distinct flows?

Accepted Answer

index=ecommerce | transaction flow_id | stats count. Correlating the three event types into one transaction per flow_id reduces each purchase flow to a single event. Counting those transaction events with stats count yields the number of distinct flows. Counting raw events or distinct field values instead measures events or identifiers, not completed flows, and can misstate the total when flows are partial or identifiers repeat.

Answer

index=ecommerce | transaction flow_id | stats dc(flow_id)

Answer

index=ecommerce | stats count by flow_id

Answer

index=ecommerce | stats dc(flow_id)

Question 13

A SOC analyst uses `transaction session_id maxspan=30m maxpause=5m` to group web session events. They notice that a single session_id sometimes produces two separate transactions even though the events are only 3 minutes apart. The events have identical session_id values but were indexed from two different indexers. Which explanation is most likely?

Accepted Answer

The transaction command splits groups when events are not sorted by _time, so the analyst must add `| sort 0 _time` before the transaction.. Transaction groups events in the order they are processed and starts a new transaction whenever it sees an event that predates the current group's latest event. When results from multiple indexers arrive interleaved, that out-of-order arrival splits a session. Sorting by _time before transaction restores chronological processing so all events for a session_id are grouped together.

Answer

The session_id field is multivalued on some events, so transaction treats each value as a separate group.

Answer

Two indexers cause the events to have different host values, and transaction groups by host by default.

Answer

The maxpause value is too small and must be increased to cover the 3-minute gap.

Question 14

A security operations center (SOC) uses Splunk to monitor VPN sessions. Each session generates a `vpn_start` event and a `vpn_end` event, both containing a `session_id` field. The SOC wants to calculate the exact duration of each session and also identify sessions that never received an end event. The analyst writes a search using the `transaction` command. Which two actions should the analyst take to ensure the search correctly captures both completed and incomplete sessions? (Choose two.)

Accepted Answer

Use the `closed` option set to `false` explicitly to ensure that transactions without an end event are included in the results.. To capture both completed and incomplete VPN sessions, the transaction command must include transactions that lack the end event. By default, `closed=false`, so transactions without an end event are returned. Explicitly setting `closed=false` ensures this behavior. Using `closed=true` would exclude incomplete sessions. Other options like `maxpause` or `maxspan` do not directly enable capturing incomplete sessions and may inadvertently filter them out.

Answer

Add `maxpause=30m` to the transaction command to limit the maximum time between events and prevent grouping of unrelated sessions.

Answer

Use `transaction session_id startswith=("action=vpn_start") endswith=("action=vpn_end") closed=true` to include only complete sessions and then use a separate search to find incomplete sessions.

Answer

Use `transaction session_id startswith=("action=vpn_start") endswith=("action=vpn_end") maxspan=1h` to limit the transaction duration and automatically include incomplete sessions.

Question 15

A Splunk Power User is analyzing application logs where each request generates a `request_id` and multiple events with a `step` field (e.g., `step=start`, `step=process`, `step=end`). They use `transaction request_id` to group events. The resulting transactions have a `duration` field, but the analyst needs to calculate the average time spent in the `process` step only. Which approach should the analyst use?

Accepted Answer

Avoid `transaction` and instead use `stats` with `min(_time)` and `max(_time)` grouped by `request_id` and `step`, then use `eval` to calculate the difference between the `process` and `start` step times.. To calculate the time spent in a specific step, the analyst should avoid the `transaction` command because it aggregates events and does not preserve individual timestamps in an easily accessible way. Instead, using `stats` to group by `request_id` and `step` and computing `min(_time)` and `max(_time)` for each step allows precise calculation of step durations. Then `eval` can subtract the start time from the process time to get the duration of the process step.

Answer

Use `transaction request_id startswith=("step=start") endswith=("step=end")` and then calculate the difference between the timestamps of the `process` and `start` events using `eval`.

Answer

Use `transaction request_id` with `mvlist=true` to preserve all events, then use `mvexpand` and `eval` to calculate the time difference between the `process` and `start` events.

Answer

Use `transaction request_id` to group events, then use `stats` with `min(_time)` and `max(_time)` filtered by `step=process` and `step=start` to calculate the duration of the `process` step.