SPLK-1003 Transactions and Event Correlation Practice Test 5 — 15 Questions

Question 1

An analyst needs to correlate events from two different data sources (web logs and database logs) based on a common session ID. The events occur within a short time window of 5 seconds. Which command is most appropriate?

Accepted Answer

transaction sessionid. The transaction command is designed to group events that share a common field, regardless of source, and can be constrained with maxspan. Option A is the most direct and efficient method.

Answer

transaction sessionid maxspan=5s

Answer

join type=inner sessionid [search index=db]

Answer

append [search index=db]

Question 2

A search using the transaction command is producing many partial transactions that are closed due to maxpause, but these transactions are often relevant and should not be discarded. Which option should be added to the transaction command to keep these partial results?

Accepted Answer

closed=true. The keepevicted=true option retains transactions that are closed because of maxpause or maxspan, ensuring they are included in results.

Answer

keepopen=true

Answer

keepevicted=true

Answer

partial=true

Question 3

When using the transaction command to group events, which field is automatically added to the event to indicate the start time of the transaction?

Accepted Answer

_starttime. Transaction adds _starttime, _endtime, duration, and eventcount fields. _starttime represents the timestamp of the first event in the transaction.

Answer

_time

Answer

duration

Answer

None, the transaction command does not add such a field.

Question 4

A Splunk Power User needs to find the average duration of user sessions. The sessions are defined by a 'user_id' field and have a max inactivity of 15 minutes. Which search correctly calculates this?

Accepted Answer

index=main | transaction user_id maxpause=15m | stats avg(duration). The transaction command with maxpause=15m groups events by user_id and adds a duration field. The stats command then calculates the average duration.

Answer

index=main | transaction user_id maxpause=15m | eval avg=avg(duration)

Answer

index=main | transaction user_id maxpause=15 | stats avg(_time)

Answer

index=main | transaction user_id maxspan=15m | stats avg(duration)

Question 5

Consider the following search: 'index=web | transaction sessionid maxspan=30m | where eventcount > 5 | stats avg(duration)'. An analyst notices that the search takes a long time and uses excessive memory. Which change would most likely improve performance?

Accepted Answer

Use the stats command with values(sessionid) instead of transaction.. Filtering events before the transaction command reduces the number of events processed, lowering memory and time requirements.

Answer

Change maxspan to 1h to allow more events.

Answer

Remove the where clause and use stats after transaction.

Answer

Add a filter before transaction to reduce events.

Question 6

A Splunk search uses 'transaction clientip maxpause=5m'. What does the maxpause setting control?

Accepted Answer

The maximum time gap between events in the transaction.. maxpause sets the maximum inactivity timeout: if no new event for the same clientip arrives within 5 minutes, the transaction is closed.

Answer

The maximum number of transactions allowed.

Answer

The maximum number of events in the transaction.

Answer

The maximum total time span of the transaction.

Question 7

An analyst wants to group events from different sourcetypes (web_access and error_log) into a single transaction when they share the same 'request_id' field and occur within 1 minute. Which search correctly accomplishes this?

Accepted Answer

(sourcetype=web_access OR sourcetype=error_log) | transaction request_id maxspan=1m. Using OR to combine sourcetypes and then transaction with maxspan=1m groups events by request_id across both sourcetypes, with a total time limit of 1 minute.

Answer

index=* | transaction request_id maxspan=1m

Answer

index=main | join type=inner request_id [search sourcetype=error_log]

Answer

sourcetype=web_access | transaction request_id maxspan=1m | append [search sourcetype=error_log | transaction request_id maxspan=1m]

Question 8

A search includes 'transaction userid maxspan=1h maxopentxn=1000'. What is the purpose of maxopentxn?

Accepted Answer

It limits the total number of transactions in the search results.. maxopentxn limits the number of transactions kept in memory at a time. When the limit is reached, the oldest open transaction is closed and removed from memory.

Answer

It limits the number of transactions that can be open simultaneously in memory.

Answer

It limits the number of events per transaction.

Answer

It limits the time span of open transactions.

Question 9

Which TWO fields are automatically created by the transaction command? (Select exactly 2 correct answers.)

Accepted Answer

_endtime. The transaction command adds _starttime and _endtime fields to each event in the transaction. It also adds duration and eventcount, but those are not listed as options. _time and maxpause are not created by transaction.

Answer

total_events

Answer

_time

Answer

maxpause

Question 10

Which THREE of the following are valid ways to correlate events in Splunk? (Select exactly 3 correct answers.)

Accepted Answer

Using the join command with a common field.. Transaction groups events based on common fields. Join can correlate events from two searches. Stats with values can also correlate by grouping events into a single result. Append and subsearch do not perform correlation.

Answer

Using the subsearch command.

Answer

Using the append command.

Question 11

Which THREE strategies can help reduce memory usage when using the transaction command? (Select exactly 3 correct answers.)

Accepted Answer

Filter events before the transaction command.. Reducing maxspan and maxpause limits the time window, thus fewer open transactions. Filtering events early and using the fields command to limit fields reduce data volume. Increasing maxopentxn and keepevicted=true increase memory usage.

Answer

Use keepevicted=true.

Answer

Increase maxopentxn.

Question 12

Refer to the exhibit. What is the purpose of the 'maxpause=5m' parameter in this search?

Accepted Answer

It closes the transaction if there is no new event from the same clientip within 5 minutes.. maxpause sets the inactivity timeout: if no new event from the same clientip arrives within 5 minutes, the transaction is closed.

Answer

It limits the number of events in a transaction to 5.

Answer

It limits the total time span of each transaction to 5 minutes.

Answer

It pauses the search for 5 minutes between transactions.

Question 13

Refer to the exhibit. What is the purpose of this configuration?

Accepted Answer

It defines a transaction type that can be used in search with `transaction mytransaction` to group events by clientip and userid with given time parameters.. This stanza defines a named transaction type in transaction.conf. It can be invoked in a search as `transaction mytransaction` to group events by clientip and userid with the specified time parameters.

Answer

It creates a search-time field extraction for clientip and userid.

Answer

It configures the transaction command to run automatically on all data.

Answer

It defines a transaction type that can be used in search with `transaction mytransaction` to group events by clientip and userid with given time parameters.

Question 14

Refer to the exhibit. An analyst sees that the transaction for sessionid 'abc123' has duration 120 seconds and 4 events. The events within this transaction occur at 10:00:00, 10:01:00, 10:02:00, and 10:03:00. Why did the transaction close?

Accepted Answer

The maxpause of 5 minutes was exceeded; there was no event after 10:03:00 for more than 5 minutes.. Since maxpause=5m is specified, the transaction closed 5 minutes after the last event (10:03:00) at approximately 10:08:00, but because maxspan is 10m, the 2-minute duration is well under that. The close was due to the inactivity timeout.

Answer

The transaction closed because there were only 4 events.

Answer

The transaction closed because the maxopentxn limit was reached.

Answer

The maxspan of 10 minutes was reached.

Question 15

A security analyst wants to group all authentication events (e.g., login, logout, failure) that occur within a 10-minute window for each user. The events are from multiple sources and share a common 'user' field. Which transaction command is most appropriate?

Accepted Answer

... | transaction user maxspan=600. Option A is correct because maxspan=600 seconds (10 minutes) bounds the transaction time window. Option B is incorrect because maxevents=100 may truncate transactions with more events. Option C is incorrect because startswith and endswith are not required and may exclude valid transactions. Option D is incorrect because using only maxpause could allow transactions to exceed 10 minutes if events continue.

Answer

... | transaction user maxspan=600 maxevents=100

Answer

... | transaction user maxpause=120

Answer

... | transaction user maxspan=600 startswith="login" endswith="logout"