SPLK-1002 Transactions and Event Correlation Practice Test 7 — 15 Questions

Question 1

A Splunk admin is troubleshooting a transaction that groups firewall allow and deny events by session ID. The transaction should end when a deny event occurs for that session. Which transaction option should be used to define the end condition?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

endswith="action=deny". The endswith option in the transaction command defines the condition that marks the final event of a transaction. Setting endswith="action=deny" tells Splunk to close the transaction when a deny event for that session ID is encountered, which matches the requirement that the transaction ends on a deny.

Answer

endswith="action=allow"

Answer

startswith="action=deny"

Answer

maxevents=2

Question 2

An analyst wants to correlate events from different sourcetypes (e.g., authentication logs and VPN logs) that share a common user field. The goal is to create a single event per user session containing all fields from both sourcetypes. Which command is best suited for this?

Accepted Answer

transaction. The transaction command is designed to group related events that share a common field (like a user ID) into a single event, preserving all fields from the involved events. It is ideal for correlating events across different sourcetypes (e.g., authentication and VPN logs) to form a session. Unlike join, transaction does not require a subsearch and can handle multiple sourcetypes natively.

Answer

append

Answer

union

Answer

join

Question 3

A transaction is created using the command: 'index=web status=200 OR status=404 | transaction sessionid'. The user wants to include transactions only if they contain both a 200 and a 404 status. Which additional step achieves this?

Accepted Answer

| where mvcount(mvdedup(status))>=2. `| where mvcount(mvdedup(status))>=2`. After the initial `transaction` command, each event in a transaction has a multivalue field `status` containing the status codes from all events in that transaction. The goal is to include only transactions that have both a 200 and a 404 status. Using `mvdedup(status)` removes duplicate status values, then `mvcount()` counts the distinct values. If the count is >=2, it means both statuses are present. Option A uses `keepevicted=true` which is irrelevant; option C is just a search that doesn't filter by transaction; option D counts all occurrences (including duplicates), which could be 2 even if only one status appears twice.

Answer

| transaction sessionid keepevicted=true | where mvcount(status)>=2

Answer

| search status="200" OR status="404"

Answer

| where mvcount(status)==2

Question 4

A Splunk search uses 'transaction' with a large dataset and causes a 'max transaction' error. What is the most likely cause and best practice to avoid it?

Accepted Answer

The number of open transactions exceeds the limit; use fields to reduce cardinality or increase maxopentxn.. The 'max transaction' error occurs when the number of open transactions exceeds the default limit (maxopentxn) during a transaction search. The best practice is to reduce the cardinality of the transaction by using fields to group events more efficiently, or to increase the maxopentxn limit if appropriate. This error is about the number of concurrent open transactions, not about maxspan or maxevents.

Answer

The transaction command is used on non-indexed fields; use indexed fields instead.

Answer

The maxspan value is too low; increase maxspan.

Answer

The maxevents value is too low; increase maxevents.

Question 5

An analyst is using the transaction command to group events by a field that has high cardinality (millions of unique values). The search is taking too long and consuming too much memory. Which approach should be taken to improve performance?

Accepted Answer

Reduce the cardinality of the field by using a derived field with fewer values.. The transaction command groups events by a field, and high cardinality (millions of unique values) forces Splunk to maintain millions of separate transaction groups in memory, causing excessive memory use and slow performance. Reducing the cardinality of the grouping field — for example, by deriving a lower-cardinality field — directly reduces the number of transaction groups and the memory footprint.

Answer

Use the 'maxspan' option to narrow the time window.

Answer

Use the 'mvlist' option to reduce field storage.

Answer

Use the 'maxevents' option to limit number of events per transaction.

Question 6

In a Splunk environment, an analyst is using the transaction command to group events from different sources. Which THREE factors are most important to consider when designing the transaction search for optimal performance? (Choose three.)

Accepted Answer

Apply efficient search-time field extractions to avoid using the transaction command across unindexed fields.. Options C, D, and E are correct. Efficient search-time field extractions (C) reduce the overhead of the transaction command by avoiding unindexed field lookups. Limiting the time range with maxspan (D) narrows the search window, reducing the number of events to process. Using fields with low cardinality for grouping (E) minimizes the number of open transactions and memory usage. Option A (mvlist) is not a standard transaction option and does not improve performance; Option B (large maxevents) can degrade performance by consuming excessive memory.

Answer

Use the 'mvlist' option to store multiple values.

Answer

Use a large maxevents value to ensure all events are captured.

Question 7

Which TWO statements about the 'transaction' command are true? (Choose two.)

Accepted Answer

The 'transaction' command can include events from multiple sourcetypes.. Option C is correct because the transaction command groups events by shared field values (such as a transaction ID) and does not restrict events to a single sourcetype, so a transaction can span multiple sourcetypes as long as the grouping fields and time constraints match. Option D is correct because transaction's core behavior is to group related events using common field values (via the maxspan, maxpause, startswith, endswith, or common-field matching) combined with time proximity constraints like maxspan and maxpause. Option A is incorrect because transaction can be used alongside stats (for example, ... | transaction ... | stats ...), and there is no such prohibition. Option B is incorrect because transaction does not require indexed fields; it can group on any extracted or calculated field, not just indexed ones. Option E is incorrect because transaction does not require all events to come from the same host; events from different hosts can be grouped if they share the grouping field values and satisfy the time constraints.

Answer

The 'transaction' command cannot be used with the 'stats' command.

Answer

The 'transaction' command only works on indexed fields.

Answer

The 'transaction' command requires all events to be from the same host.

Question 8

A large transaction command is causing the search to run out of memory. Which approach best reduces memory usage while maintaining the transaction logic?

Accepted Answer

Use the fields option to include only necessary fields.. Using the fields option to include only necessary fields reduces memory usage because the transaction command by default keeps all fields from the events, which can be memory-intensive. By specifying only the fields needed for the transaction logic, Splunk can discard unnecessary data, significantly lowering memory footprint while preserving the transaction grouping. This is the best approach to maintain transaction logic while optimizing memory.

Answer

Increase the maxeventtokens setting.

Answer

Replace transaction with stats to aggregate.

Answer

Use timeline to store transactions.

Question 9

Which transaction option should be used to ensure that a transaction does not exceed a total duration of 10 minutes?

Accepted Answer

maxspan=10m. The maxspan option in the transaction command defines the maximum total duration of a transaction, measured from the first event to the last event. Setting maxspan=10m ensures that no transaction spans more than 10 minutes, regardless of event count or pauses. This directly satisfies the requirement to limit total transaction duration.

Answer

endswith="end"

Answer

maxpause=10m

Answer

startswith="start"

Question 10

Which command is best for calculating a running total of sales per customer across events without creating a multivalued field?

Accepted Answer

streamstats. The streamstats command calculates cumulative (running) statistics as it processes events in order, adding the result to each event without collapsing them into a single row. This makes it ideal for computing a running total of sales per customer across events while preserving the event-level detail and avoiding a multivalued field. By using streamstats with a sum(sales) and a by-clause for customer, you get an incremental total on each event.

Answer

stats

Answer

transaction

Answer

eventstats

Question 11

A search uses transaction to group login and logout events. What happens if a user has multiple logins before logging out?

Accepted Answer

The transaction will include the first login and all events until the first logout.. Splunk's transaction command groups events between a start and end marker. When a user has multiple logins before a logout, the transaction begins at the first login event and continues until the first matching logout event, encompassing all intermediate events. Subsequent logins are absorbed into that same transaction rather than starting new ones.

Answer

The search will fail due to overlapping transactions.

Answer

It will create multiple transactions for each login.

Answer

It will ignore the first login and start at the last login.

Question 12

A company wants to correlate events from multiple sources that share a common transaction ID. The events arrive in real time but with variable delays. Which transaction option ensures that a transaction closes after 2 minutes of inactivity?

Accepted Answer

maxpause=2m. The maxpause option in Splunk's transaction command specifies the maximum time between events in a transaction. Setting maxpause=2m ensures that if there is a gap of more than 2 minutes between events, the transaction is closed. This matches the requirement to close after 2 minutes of inactivity.

Answer

endswith="end"

Answer

maxspan=2m

Answer

startswith="start"

Question 13

Which TWO of the following are valid reasons to use transaction instead of stats for event correlation?

Accepted Answer

When you need to preserve the full events for each group.. Option A is correct because the transaction command retains the individual raw events that make up each group, whereas stats aggregates and discards the underlying events, so transaction is required when you must preserve the full events for each correlated group. Option C is correct because transaction supports the maxspan, maxpause, and maxopentxn options to enforce a time window between events, while stats has no built-in mechanism to constrain grouping by elapsed time. Option B is not a valid reason because transaction is memory- and resource-intensive and is generally discouraged for very large datasets, where stats is preferred. Option D is not a valid reason because transaction typically performs slower than stats, not faster, due to its grouping and event-retention overhead. Option E is not a valid reason because both transaction and stats can group events across different sourcetypes, so this does not distinguish transaction as the better choice.

Answer

When working with very large datasets.

Answer

When you need faster search performance.

Answer

When events come from different sourcetypes.

Question 14

A security analyst wants to group all events from a single web session into one transaction. The session is identified by a 'sessionId' field, and events are generated over a period that can last up to 30 minutes. The analyst also wants to close the transaction if there is no activity for more than 10 minutes. Which transaction parameters should be used?

Accepted Answer

maxspan=30m, maxpause=10m. The maxspan=30m parameter ensures that the transaction does not exceed 30 minutes total, matching the session duration. The maxpause=10m parameter closes the transaction if there is no activity for more than 10 minutes, which aligns with the requirement to end the transaction after 10 minutes of inactivity. Together, they correctly group events for the web session.

Answer

maxspan=30m, maxpause=5m

Answer

maxspan=10m, maxpause=30m

Answer

maxspan=1h, maxpause=10m

Question 15

An analyst needs to correlate events from two different data sources (web logs and database logs) based on a common session ID. The events occur within a short time window of 5 seconds. Which command is most appropriate?

Accepted Answer

transaction sessionid maxspan=5s. The transaction command groups events that share a common field value (sessionid) into a single transaction, and the maxspan=5s argument limits the maximum time between the first and last event in a transaction to 5 seconds. This directly matches the requirement to correlate web and database logs by session ID within a 5-second window.

Answer

transaction sessionid

Answer

join type=inner sessionid [search index=db]

Answer

append [search index=db]