SPLK-1002 Transactions and Event Correlation Practice Test 7 — 15 Questions

Question 1

A search includes `... | transaction 1,2,3` but returns unexpected results. What does the `1,2,3` represent in this context?

Accepted Answer

maxspan=1s, maxpause=2s, maxevents=3. When the `transaction` command is given three numeric arguments without field names, they are interpreted as `maxspan`, `maxpause`, and `maxevents` respectively. Therefore, `1,2,3` means maxspan=1 second, maxpause=2 seconds, and maxevents=3. Option A is wrong because these are not field names; transaction keys are specified by providing field names as arguments. Option B is wrong because transaction does not correlate across indexes; it groups events based on fields or time. Option C is wrong because these are not status codes; transaction uses temporal settings and event count limits.

Answer

Field names to use as transaction keys

Answer

Three index names to correlate across indexes

Answer

Status codes for transactions (1=open, 2=pending, 3=closed)

Question 2

A company uses `transaction` to group events by `order_id`. Some orders have many events (1000+). Which option should be added to prevent a single transaction from consuming too many resources?

Accepted Answer

maxevents=500. Maxevents=500. This option limits the number of events that can be included in a single transaction, preventing a transaction with many events (like 1000+) from consuming too many resources. Option A (keepevicted=true) retains evicted events but does not limit resource usage. Option B (maxspan=1h) limits the time span of the transaction, not the event count. Option D (maxpause=5m) limits the time between events but does not cap the total number of events.

Answer

keepevicted=true

Answer

maxspan=1h

Answer

maxpause=5m

Question 3

An analyst runs `sourcetype=access_combined | transaction clientip` and notices many single-event transactions. Which option would help close transactions more accurately?

Accepted Answer

Add `endswith="status=200"`. Adding `endswith` helps define when a transaction should close, reducing false single-event transactions (e.g., 200 status often indicates end). Option B (maxpause) might help but not as targeted. Option C (closedelay) is not valid. Option D (null) is not helpful.

Answer

Increase maxpause to 1 hour

Answer

Do nothing; single events are fine

Answer

Set closedelay=10

Question 4

A search uses `transaction` with wildcard fields (e.g., `*id`), causing poor performance. What is the best practice to optimize this?

Accepted Answer

Specify exact field names instead of wildcards. Using specific field names instead of wildcards reduces the overhead of matching multiple fields, improving transaction performance. Option B is invalid syntax; `nullif` is not a transaction option here. Option C increases limits but does not address the root cause of wildcard inefficiency. Option D changes the approach to `stats`, which may not preserve transaction boundaries.

Answer

Use `transaction *id, nullif=null`

Answer

Increase maxopentxn in limits.conf

Answer

Replace transaction with stats

Question 5

A team wants to correlate events from different sourcetypes (web, db) on a common `sessionid`. They use `transaction sessionid` across both sourcetypes. The results show that some transactions are missing events. What is the most likely cause?

Accepted Answer

Timestamps from different sourcetypes are misaligned. Sourcetypes may have different timestamp formats or time zones, causing events to be incorrectly sorted out of the transaction window. Option C (maxevents) would truncate but not miss events. Option D (field name) is unlikely. Option A (search time level) is not relevant.

Answer

The search is running at 'info' level instead of 'verbose'

Answer

maxevents is set too low

Answer

sessionid field has different names in each sourcetype

Question 6

Which TWO options are valid parameters of the `transaction` command?

Accepted Answer

maxpause. Correct options: B (maxpause) and D (keepevicted). Option A (timeformat) is for time parsing, not transaction. Option C (sequential) is not a valid parameter of the `transaction` command. Option E (fieldlist) is not a parameter; fields are given as arguments.

Answer

timeformat

Answer

sequential

Answer

fieldlist

Question 7

Which TWO conditions can cause a transaction to be evicted?

Accepted Answer

Maximum pause between events exceeded. Correct options: A (Maximum pause between events exceeded) and C (Maximum number of events per transaction reached). These are two conditions that cause a transaction to be evicted. Option B (Timestamp format mismatch) does not cause eviction; it may cause events not to be grouped. Option D (Transaction has too many fields) is not a standard eviction condition. Option E (Search is canceled by user) stops the search, not evicts a transaction.

Answer

Timestamp format mismatch

Answer

Transaction has too many fields

Answer

Search is canceled by user

Question 8

Which THREE statements about the `transaction` command are true?

Accepted Answer

It can correlate events from different sourcetypes. Correct: A, C, D. A is true because the `transaction` command can correlate events from different sourcetypes into a single transaction. C is true because `transaction` sorts events within each transaction by `_time` to ensure chronological ordering. D is true because `transaction` can correlate events across multiple indexes. B is false because the `maxevents` option limits the maximum number of events per transaction, not the number of unique field values. E is false because `transaction` does not produce summary indexing output by default; it outputs events with a calculated duration field.

Answer

The maxevents option limits the number of unique field values per transaction

Answer

Transaction always produces summary indexing output

Question 9

Refer to the exhibit. A security analyst runs the above search. Which of the following best describes the result?

Accepted Answer

Transactions beginning with 'allow' and ending with 'deny' for src_ip 10.0.0.1, with a maximum duration of 5 minutes. The transaction command groups events by src_ip=10.0.0.1 with startswith='allow' and endswith='deny' and a maxspan of 5 minutes. This forms transactions that begin with an 'allow' event and end with a 'deny' event within a 5-minute window for that source IP. Option A is incorrect because the search filters events for src_ip 10.0.0.1 only, not all source IPs. Option B is incorrect because it describes transactions of all firewall events, but the start and end conditions restrict the events filtered. Option C is incorrect because it reverses the start and end conditions (start with deny, end with allow) whereas the search specifies start with allow and end with deny.

Answer

Transactions for all source IPs, but only showing src_ip 10.0.0.1 in the table

Answer

Transactions of all firewall events for src_ip 10.0.0.1, each lasting up to 5 minutes

Answer

Transactions of src_ip 10.0.0.1 that start with deny and end with allow

Question 10

Refer to the exhibit. An analyst runs the above search to test transaction behavior. What is the likely result?

Accepted Answer

Multiple transactions, each with fewer events, avg duration less than 10s. The search uses `transaction` with `maxspan=10s`. The random timestamps are spread over up to 100 seconds, so events that are more than 10 seconds apart cannot be in the same transaction. Thus, the events will be split into multiple transactions, each containing a subset of the events. The average duration of these transactions will be well under 10 seconds, making option C correct. Option A is incorrect because not all 5 events can fit into one 10-second window. Option B is incorrect for the same reason. Option D is incorrect because transactions are still created for events that do fall within a 10-second window.

Answer

One transaction with 5 events, avg duration ~50s

Answer

One transaction with 5 events, avg duration ~10s

Answer

No transactions created because events are out of order

Question 11

A large e-commerce company uses Splunk to analyze customer purchase funnels. Their environment includes 10 indexers and a search head cluster. They have a search that runs every 5 minutes to correlate events from web logs, order logs, and payment logs using the `transaction` command on a common `order_id` field. The search uses `transaction order_id maxevents=50 maxspan=30m`. Recently, users have reported that some orders are missing from the results, especially for high-volume periods. The team also notices that dashboard searches often timeout. They suspect the transaction command is the bottleneck. Upon examining the search, they see that the web logs alone generate hundreds of events per order. Which course of action would best address the missing orders and performance issues?

Accepted Answer

Replace transaction with stats by order_id, using list() for relevant fields and evaluating event order separately. The `transaction` command is resource-intensive and can cause timeouts and missing data when `maxevents` is exceeded. Increasing `maxevents` (A) would worsen performance. Removing `maxpause` and increasing `maxspan` (B) does not address the `maxevents` limit and may keep transactions open longer. Reducing `maxevents` (C) would exacerbate missing orders. Replacing `transaction` with `stats ... list() by order_id` groups fields without holding open transactions, avoiding the `maxevents` constraint and reducing resource usage, thus addressing both missing orders and performance issues.

Answer

Increase maxevents to 200 and increase search timeout

Answer

Remove maxpause and set maxspan to 60m

Answer

Reduce maxevents to 10 to limit resource usage

Question 12

A security team needs to group all login events from the same user session. Events include 'login' and 'logout' with a common session_id field. Which command should be used to combine these events into a single event per session?

Accepted Answer

transaction session_id. The `transaction` command is designed to group related events based on common fields and time constraints, making it ideal for combining login and logout events by session_id.

Answer

join session_id

Answer

stats by session_id

Answer

append session_id

Question 13

An analyst runs `transaction user_id` to correlate events from a web server. The resulting transaction events have a field 'duration' that shows the time between the first and last event. However, some transactions span over 30 minutes. What transaction option should be added to limit the maximum time between the first and last event?

Accepted Answer

maxspan=30m. The maxspan option sets the maximum time span from the first event to the last event in a transaction.

Answer

maxpause=30m

Answer

maxevents=30

Answer

contime=30m

Question 14

A SOC analyst is investigating a security incident. They use `transaction src_ip` to group firewall events. The search returns too many single-event transactions. The analyst suspects that some events should be grouped but are not because the IP address is used by different sessions. Which option can help ensure events are grouped only if they occur close in time?

Accepted Answer

maxpause=5m. The maxpause option sets the maximum time gap allowed between consecutive events in a transaction. Using a short maxpause helps ensure that events from different sessions are not incorrectly grouped.

Answer

maxspan=1h

Answer

maxevents=2

Answer

fields=src_ip

Question 15

A search uses `transaction sessionId` to correlate events. However, the transaction command is consuming too much memory and the search fails. Which approach can reduce memory usage while still approximating the transaction grouping?

Accepted Answer

Use `stats values(_raw) by sessionId`. Using `stats values(_raw) by sessionId` aggregates raw events into a multivalue field, which is more memory-efficient than transaction because it does not try to compute duration or keep all event metadata.

Answer

Add `maxevents=100` to the transaction

Answer

Use `dedup sessionId`

Answer

Increase the search job memory limit