SPLK-1003 Transactions and Event Correlation Practice Test 6 — 15 Questions

Question 1

An analyst uses transaction to group web requests by session_id. Some transactions are unexpectedly large, containing hundreds of events. What parameter should be adjusted to limit the number of events per transaction?

Accepted Answer

maxevents. Option B is correct because maxevents limits the number of events in a transaction. Option A (maxspan) limits time, not count. Option C (maxpause) limits idle time. Option D (mvcount) counts multivalue fields, not events.

Answer

maxspan

Answer

maxpause

Answer

mvcount

Question 2

A Splunk admin notices that a transaction search using the transaction command takes a long time and consumes high memory. The search correlates events by a high-cardinality field (IP address) across multiple indexers. Which optimization technique should be applied first?

Accepted Answer

Use the fields command to remove unnecessary fields before the transaction.. Option C is correct because using the fields command to remove unnecessary fields before the transaction reduces memory and processing. Option A (local) limits to one indexer, reducing parallelism and potentially increasing time. Option B (increasing maxevents) would increase memory. Option D (keepevicted) does not optimize performance.

Answer

Increase maxevents to capture more events per transaction.

Answer

Use the keepevicted option to retain incomplete transactions.

Answer

Use the local parameter to force local processing.

Question 3

An analyst wants to ensure that a transaction is only considered complete when it contains a specific end event. Which transaction parameter should be used?

Accepted Answer

endswith. Option D is correct because endswith defines the event that closes a transaction. Option A (startswith) defines the start event. Option B (maxspan) bounds total time. Option C (maxpause) bounds idle time.

Answer

startswith

Answer

maxpause

Answer

maxspan

Question 4

An analyst wants to correlate events from multiple sourcetypes that have different timestamps but share a common reference ID. The events are ingested with some delay. Which parameter is crucial to ensure the transaction captures all related events despite ingestion delay?

Accepted Answer

maxspan. Option D is correct because a large maxspan accommodates delays in event arrival. Option A (maxpause) would not capture events if there is a large gap. Option B (maxevents) does not affect time. Option C (fields _indextime) is irrelevant.

Answer

maxpause

Answer

maxevents

Answer

fields _indextime

Question 5

A transaction search is processing too many fields. Which command should be used immediately before the transaction command to reduce memory usage?

Accepted Answer

fields user_id, _time. Option C is correct because 'fields user_id, _time' keeps only the essential fields. Option A is incorrect because it removes _raw and _time, but keeps other fields. Option B is incorrect because 'fields - * except user_id' removes _time. Option D is incorrect because 'fields +' appends, not replaces.

Answer

fields - _raw, _time

Answer

fields + user_id, _time

Answer

fields - * except user_id

Question 6

An analyst wants to find transactions where the first event was a 'login' and the last event was a 'logout'. Which post-transaction filter is correct?

Accepted Answer

where mvindex(action,0)="login" AND mvindex(action,-1)="logout". Option A is correct because mvindex accesses the first (index=0) and last (index=-1) values of a multivalue field. Option B uses invalid syntax. Option C uses nonexistent functions. Option D would match if both values appear anywhere, not necessarily first/last.

Answer

where action[0]="login" AND action[-1]="logout"

Answer

where first(action)="login" AND last(action)="logout"

Answer

where action="login" AND action="logout"

Question 7

A transaction search that uses a large maxspan and high-cardinality fields is failing due to memory limitations. Which approach can best reduce memory usage without changing the transaction logic?

Accepted Answer

Use the 'fields' command before transaction to retain only the correlation fields and _time.. Option A is correct because using the fields command to retain only correlation fields and _time dramatically reduces memory per event. Option B (increasing maxpause) does not reduce memory. Option C (keepevicted) increases memory usage. Option D (stats) changes the logic entirely.

Answer

Use the 'stats' command with values() instead of transaction.

Answer

Increase the maxpause value to reduce number of open transactions.

Answer

Set keepevicted=true to offload evicted events.

Question 8

An analyst wants to group events by 'session_id' but only if the events occur within 5 minutes of each other, and there must be at least 2 events per transaction. Which transaction parameters achieve this?

Accepted Answer

transaction session_id maxpause=300 minevents=2. Option C is correct because maxpause=300 ensures events are within 5 minutes of each other, and minevents=2 ensures at least 2 events. Option A (maxspan=300) only limits total time. Option B (maxevents=2) limits event count but not grouping window. Option D (minpause) is not a valid parameter.

Answer

transaction session_id maxspan=300

Answer

transaction session_id maxspan=300 maxevents=2

Answer

transaction session_id maxspan=300 minpause=300

Question 9

Which two statements about the transaction command are correct? (Choose two.)

Accepted Answer

The transaction command automatically adds an 'eventcount' field.. Options A and D are correct. The transaction command automatically adds duration and eventcount fields. Option B is false because startswith/endswith are optional. Option C is false because transaction can correlate events from different sourcetypes. Option E is false because transaction can work across indexes.

Answer

The transaction command requires a startswith or endswith parameter.

Answer

The transaction command can only correlate events within the same sourcetype.

Answer

The transaction command can be used with events from different indexes.

Question 10

Which three conditions can cause a transaction to close prematurely? (Choose three.)

Accepted Answer

The maxevents value is reached.. Options A, B, and C are correct. maxspan, maxpause, and maxevents all cause transactions to close when their limits are reached, potentially before all related events are grouped. Option D (endswith) closes the transaction by design, not prematurely. Option E (startswith again) can start a new transaction but does not necessarily close the current one prematurely.

Answer

The startswith event is encountered again.

Answer

The endswith event is detected.

Question 11

Which two techniques should be used to optimize a transaction search that is slow due to a high volume of events? (Choose two.)

Accepted Answer

Use the 'fields' command to limit fields before transaction.. Options A and D are correct. Using fields before transaction reduces memory and processing. Using stats instead of transaction can be more efficient for some correlations. Option B (local) reduces parallelism. Option C (increasing maxspan) typically increases resource usage. Option E (keepevicted) does not optimize performance.

Answer

Use the 'keepevicted' option to free memory.

Answer

Use the 'local' parameter to process on a single indexer.

Answer

Increase the maxspan value to reduce the number of transactions.

Question 12

A Splunk admin wants to group events from the same user session in web logs. Which transaction option should be used to ensure the transaction ends after 30 minutes of inactivity?

Accepted Answer

maxpause=30m. Option B is correct because maxpause ends the transaction if the time between events exceeds the specified duration. Option A (maxspan) limits total duration, not inactivity. Option C (maxevents) limits the number of events. Option D (keepevicted) retains partial transactions that were evicted.

Answer

keepevicted=true

Answer

maxspan=30m

Answer

maxevents=100

Question 13

An analyst runs the following search to correlate login and logout events: `index=auth | transaction user startswith="LOGIN" endswith="LOGOUT"`. However, some transactions span over 24 hours. Which option should be added to limit each transaction to a maximum of 8 hours?

Accepted Answer

maxspan=8h. Option D is correct because maxspan=8h limits the total time window of the transaction to 8 hours. Option A (maxpause) limits inactivity, not total duration. Option B (maxevents) limits event count. Option C (duration) is not a valid transaction option.

Answer

maxevents=10

Answer

duration=8h

Answer

maxpause=8h

Question 14

A security team notices that using `transaction` on a large dataset of firewall logs causes memory issues. Which alternative approach would most efficiently correlate events while reducing resource consumption?

Accepted Answer

Use `stats` by session_id list(src_ip), list(dest_ip) with `bin` time. Option A is correct because `stats` with `list()` and `values()` is more memory-efficient than `transaction` for correlating events. Option B (increasing limits) is a workaround but not efficient. Option C (concurrency) is not applicable. Option D (`append`) is less efficient.

Answer

Use `concurrency` command to group events

Answer

Increase `maxtransize` and `maxopentxn` in limits.conf

Answer

Use `append` with subsearch to join events

Question 15

A Splunk admin wants to group events that share a common `session_id` field. Events arrive out of order. Which transaction field will automatically sort events correctly?

Accepted Answer

transaction automatically sorts by time. Option C is correct because `transaction` automatically sorts events by time within each transaction. Option A (sort) is not a transaction option. Option B (index order) is not guaranteed. Option D (timeordered) is not a valid option.

Answer

sort=_time

Answer

Use option `timeordered=true`

Answer

No sorting needed; events are indexed in order