SPLK-1002 Transactions and Event Correlation Practice Test 6 — 15 Questions

Question 1

An analyst uses transaction to group web requests by session_id. Some transactions are unexpectedly large, containing hundreds of events. What parameter should be adjusted to limit the number of events per transaction?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

maxevents. Maxevents limits the number of events in a transaction. Option A (maxspan) limits the maximum time span of the transaction. Option B (maxpause) limits the maximum pause between events. Option C (mvcount) is used to count multivalue fields, not to limit event count.

Answer

maxspan

Answer

maxpause

Answer

mvcount

Question 2

A Splunk admin notices that a transaction search using the transaction command takes a long time and consumes high memory. The search correlates events by a high-cardinality field (IP address) across multiple indexers. Which optimization technique should be applied first?

Accepted Answer

Increase maxevents to capture more events per transaction.. The correct optimization technique is to increase maxevents, which allows the transaction command to capture more events per transaction, reducing the number of incomplete transactions and improving performance. The fields command reduces data but does not directly address transaction boundaries. The keepevicted option retains incomplete transactions without optimizing performance. The local parameter limits parallelism, increasing time and memory usage on a single indexer.

Answer

Use the fields command to remove unnecessary fields before the transaction.

Answer

Use the keepevicted option to retain incomplete transactions.

Answer

Use the local parameter to force local processing.

Question 3

An analyst wants to ensure that a transaction is only considered complete when it contains a specific end event. Which transaction parameter should be used?

Accepted Answer

endswith. The endswith parameter specifies the event that marks the end of a transaction. Option A (startswith) defines the start event. Option C (maxpause) sets the maximum idle time between events. Option D (maxspan) sets the maximum total duration of the transaction.

Answer

startswith

Answer

maxpause

Answer

maxspan

Question 4

An analyst wants to correlate events from multiple sourcetypes that have different timestamps but share a common reference ID. The events are ingested with some delay. Which parameter is crucial to ensure the transaction captures all related events despite ingestion delay?

Accepted Answer

maxspan. A large maxspan accommodates delays in event arrival. Option A (maxpause) would not capture events if there is a large gap. Option B (maxevents) does not affect time. Option C (fields _indextime) is irrelevant.

Answer

maxpause

Answer

maxevents

Answer

fields _indextime

Question 5

A transaction search is processing too many fields. Which command should be used immediately before the transaction command to reduce memory usage?

Accepted Answer

fields user_id, _time. The 'fields' command with a positive list (without '+' or '-') sets the field list to exactly those specified, keeping only user_id and _time. This reduces memory usage significantly before the transaction command, which typically needs _time and a grouping field like user_id. Option A is incorrect because removing _raw and _time but keeping other fields does not sufficiently reduce fields; transaction requires _time. Option B is incorrect because 'fields +' adds fields to the existing set, not replacing them, so it does not reduce memory. Option C is incorrect because 'fields - * except user_id' removes all fields except user_id, but also removes _time, which is essential for the transaction command to correlate events based on time.

Answer

fields - _raw, _time

Answer

fields + user_id, _time

Answer

fields - * except user_id

Question 6

An analyst wants to find transactions where the first event was a 'login' and the last event was a 'logout'. Which post-transaction filter is correct?

Accepted Answer

where mvindex(action,0)="login" AND mvindex(action,-1)="logout". The correct filter uses mvindex to access the first and last values of the multivalue 'action' field created by the transaction command. Option A uses invalid array indexing (action[0] is not valid in Splunk). Option B uses nonexistent functions first() and last(). Option C would require a single event to have both values simultaneously, which is impossible. Option D correctly uses mvindex(action,0) for the first event and mvindex(action,-1) for the last event, ensuring the transaction starts with 'login' and ends with 'logout'.

Answer

where action[0]="login" AND action[-1]="logout"

Answer

where first(action)="login" AND last(action)="logout"

Answer

where action="login" AND action="logout"

Question 7

A transaction search that uses a large maxspan and high-cardinality fields is failing due to memory limitations. Which approach can best reduce memory usage without changing the transaction logic?

Accepted Answer

Use the 'fields' command before transaction to retain only the correlation fields and _time.. Using the 'fields' command before 'transaction' to retain only the correlation fields and _time reduces the amount of data held in memory for each event, directly addressing memory limitations. Option A (using 'stats' with values()) changes the logic and does not preserve the event boundary behavior of transaction. Option C (increasing maxpause) does not reduce memory; it may increase the number of concurrent open transactions. Option D (setting keepevicted=true) actually increases memory usage by keeping evicted events.

Answer

Use the 'stats' command with values() instead of transaction.

Answer

Increase the maxpause value to reduce number of open transactions.

Answer

Set keepevicted=true to offload evicted events.

Question 8

An analyst wants to group events by 'session_id' but only if the events occur within 5 minutes of each other, and there must be at least 2 events per transaction. Which transaction parameters achieve this?

Accepted Answer

transaction session_id maxpause=300 minevents=2. Maxpause=300 ensures events are within 5 minutes of each other, and minevents=2 ensures at least 2 events. Option A (maxspan=300) only limits total time. Option B (maxevents=2) limits event count but not grouping window. Option D (minpause) is not a valid parameter.

Answer

transaction session_id maxspan=300

Answer

transaction session_id maxspan=300 maxevents=2

Answer

transaction session_id maxspan=300 minpause=300

Question 9

Which three statements about the transaction command are correct? (Choose three.)

Accepted Answer

The transaction command automatically adds an 'eventcount' field.. Options A, D, and E are correct. The transaction command automatically adds the 'eventcount' and 'duration' fields to each result. It can also correlate events from different indexes, as it uses fields like ‘_time’ and a group-by field; there is no restriction that all events must come from the same index. Option B is false because startswith/endswith are optional; transaction can also use a field-based group (e.g., by session_id). Option C is false because transaction can correlate events from different sourcetypes.

Answer

The transaction command requires a startswith or endswith parameter.

Answer

The transaction command can only correlate events within the same sourcetype.

Question 10

Which three conditions can cause a transaction to close prematurely? (Choose three.)

Accepted Answer

The maxevents value is reached.. Options A, C, and D are correct. The maxevents (A), maxpause (C), and maxspan (D) settings all cause a transaction to close when their respective limits are reached, potentially before all related events are grouped, which constitutes premature closure. Option B (startswith again) does not close the current transaction; it starts a new transaction, but the previous one may close due to other limits. Option E (endswith) closes the transaction by design when the endswith event is detected, so it is not considered premature.

Answer

The startswith event is encountered again.

Answer

The endswith event is detected.

Question 11

Which two techniques should be used to optimize a transaction search that is slow due to a high volume of events? (Choose two.)

Accepted Answer

Use the 'fields' command to limit fields before transaction.. Options A and C are correct. Using the 'fields' command before 'transaction' limits the data to only relevant fields, reducing memory and processing overhead. Option C is correct because the 'stats' command with functions like values() and range() can often replace 'transaction' for event correlation, avoiding the resource-intensive transaction command. Option B is incorrect because 'keepevicted' is used to retain evicted transactions but does not free memory or optimize performance. Option D is incorrect because using the 'local' parameter restricts processing to a single indexer, which can actually harm performance by eliminating parallelism. Option E is incorrect because increasing 'maxspan' expands the time window, potentially increasing the number of events per transaction and worsening performance.

Answer

Use the 'keepevicted' option to free memory.

Answer

Use the 'local' parameter to process on a single indexer.

Answer

Increase the maxspan value to reduce the number of transactions.

Question 12

A Splunk admin wants to group events from the same user session in web logs. Which transaction option should be used to ensure the transaction ends after 30 minutes of inactivity?

Accepted Answer

maxpause=30m. Maxpause=30m. The maxpause option specifies the maximum time between events in a transaction; if the pause exceeds this value, the transaction ends. This is ideal for grouping events by user session with a 30-minute inactivity timeout. Option B (keepevicted=true) retains partial transactions that were evicted from memory, not ending criteria. Option C (maxspan=30m) limits the total time span from the first to the last event, not inactivity. Option D (maxevents=100) limits the number of events in a transaction.

Answer

keepevicted=true

Answer

maxspan=30m

Answer

maxevents=100

Question 13

An analyst runs the following search to correlate login and logout events: `index=auth | transaction user startswith="LOGIN" endswith="LOGOUT"`. However, some transactions span over 24 hours. Which option should be added to limit each transaction to a maximum of 8 hours?

Accepted Answer

maxspan=8h. Maxspan=8h limits the total time window of the transaction to 8 hours. Option A (maxevents) limits the number of events, not time. Option B (duration) is not a valid transaction option. Option C (maxpause) limits inactivity between events, not the total span.

Answer

maxevents=10

Answer

duration=8h

Answer

maxpause=8h

Question 14

A security team notices that using `transaction` on a large dataset of firewall logs causes memory issues. Which alternative approach would most efficiently correlate events while reducing resource consumption?

Accepted Answer

Use `stats` by session_id list(src_ip), list(dest_ip) with `bin` time. Using `stats` with `list()` and `bin` time is more memory-efficient than `transaction` for correlating events by session_id. `transaction` creates a transaction object with all event details, consuming more memory, while `stats` aggregates fields without storing raw events. Options A (`concurrency`) is for analyzing concurrent events, not correlation; B (increasing limits) only postpones issues; C (`append`) is for combining results, not efficient correlation.

Answer

Use `concurrency` command to group events

Answer

Increase `maxtransize` and `maxopentxn` in limits.conf

Answer

Use `append` with subsearch to join events

Question 15

A Splunk admin wants to group events that share a common `session_id` field. Events arrive out of order. Which transaction field will automatically sort events correctly?

Accepted Answer

transaction automatically sorts by time. `transaction` automatically sorts events by time within each transaction. Option A (sort) is not a transaction option. Option B (index order) is not guaranteed. Option D (timeordered) is not a valid option.

Answer

sort=_time

Answer

Use option `timeordered=true`

Answer

No sorting needed; events are indexed in order