SPLK-1003 Transactions and Event Correlation Practice Test 8 — 15 Questions

Question 1

A company has events from multiple data sources that share a common 'request_id'. They want to correlate events from different sources (e.g., web, app, database) into a single transaction per request. However, the timestamps across sources are not synchronized, causing some events to appear out of order. Which approach is best to ensure correct grouping?

Accepted Answer

Use `sort _time | transaction request_id maxspan=10m`. Setting a larger maxspan and using `sort _time` before transaction can help reorder events, but the most reliable method is to use `transaction request_id` with a generous maxspan and, if needed, use `sort 0 _time` before transaction to ensure time order.

Answer

Use `eventstats count by request_id` to correlate counts

Answer

Use `transaction request_id` and rely on Splunk to automatically reorder

Answer

Use `transaction request_id maxspan=1m` and ignore out-of-order events

Question 2

A user wants to see a single consolidated event for each user session that includes the start time, end time, and total duration. The session events have a 'action' field with values 'start' and 'end' and a common 'user_id'. Which transaction command would achieve this?

Accepted Answer

`transaction user_id startswith=action=start endswith=action=end`. Using startswith and endswith defines the boundary events, and transaction automatically calculates duration when there are start and end events.

Answer

`transaction startswith=action=start endswith=action=end`

Answer

`transaction user_id`

Answer

`stats values(action) by user_id`

Question 3

A search uses `transaction session_id maxspan=30m` to group events. The search returns 5000 transaction events. The analyst needs to filter out any transaction that does not contain an event with status=failure. Which post-transaction command should be used?

Accepted Answer

`| transaction session_id maxspan=30m | search status=failure`. After transaction, you can use `where` with a subsearch or use `search` to filter based on fields within the transaction. Specifically, `search` can be used after transaction to filter events that contain a certain field-value pair.

Answer

`| transaction session_id maxspan=30m | stats count(eval(status="failure")) by session_id`

Answer

`| transaction session_id maxspan=30m | where status=failure`

Answer

`| transaction session_id maxspan=30m | eval has_failure=if(match(_raw, "failure"),1,0) | where has_failure=1`

Question 4

An analyst writes `transaction client_ip` to group events from a firewall. The resulting transactions show many events with duration=0. What is the most likely cause?

Accepted Answer

There is only one event per client_ip in the time range. A duration of 0 often occurs when there is only one event in the transaction. This can happen if the events do not meet the criteria for starting or ending a transaction, or if the maxpause is too short.

Answer

The client_ip field contains duplicates

Answer

The transaction option maxspan is set too high

Answer

The events are not time-stamped properly

Question 5

Which TWO options can be used with the `transaction` command to control how many events are included in a single transaction?

Accepted Answer

maxspan. maxevents limits the number of events per transaction. maxspan limits the time span, indirectly limiting events. maxpause limits the pause between events.

Answer

mvcount

Answer

maxpause

Answer

keepevicted

Question 6

Which THREE statements about the `transaction` command are true?

Accepted Answer

Transaction can correlate events based on more than one field.. Transaction can group events by multiple fields, calculates duration for start/end events, and can include field values from all constituent events. However, it does not support use of `where` before transaction in the same search pipeline? Actually, it can be used after. Options: A: true, B: false (maxpause limits pause, not span), C: true, D: true, E: false (transaction is memory-intensive, not recommended for large datasets).

Answer

The maxpause option sets the maximum time span of the transaction.

Answer

Transaction is the most efficient way to group events from large datasets.

Question 7

Which TWO options can be used with the `transaction` command to define the beginning and end of a transaction?

Accepted Answer

endswith. startswith and endswith define boundary events. maxspan and maxpause are constraints.

Answer

closed_txn

Answer

maxpause

Answer

maxspan

Question 8

A large e-commerce company is using Splunk to monitor user sessions across multiple microservices. Each service logs events with a common 'session_id' field. The security team wants to identify sessions where a user performed a 'password_change' action followed by a 'login' from a different IP address within 5 minutes, indicating possible account takeover. The current search uses `transaction session_id startswith=action=login endswith=action=password_change maxspan=10m`. However, the search returns very few results, and the team suspects it is missing many attacks. The logs show that sometimes 'password_change' occurs before 'login' (e.g., password reset then login) and the IP changes are observed across multiple events. The team needs to capture both orderings. Which approach should they take?

Accepted Answer

Use `transaction session_id maxspan=5m` and then filter for sessions that contain both actions. The current search only captures one order (login then password_change). To capture both orders, they should either use `transaction session_id maxspan=5m` without startswith/endswith and then filter, or use two separate transactions and combine. The best option is to use `transaction session_id maxspan=5m` and then search for events where both actions occur, because it avoids order dependency and is simpler.

Answer

Use `transaction session_id startswith=action=password_change endswith=action=login maxspan=5m` in a separate search and append results

Answer

Keep the current search but increase maxspan to 30m

Answer

Add both startswith and endswith with OR conditions: `startswith=(action=login OR action=password_change) endswith=(action=login OR action=password_change)`

Question 9

A network operations team monitors firewall logs using Splunk. They need to group events from the same TCP session, identified by 'src_ip', 'dst_ip', and 'src_port'. The logs contain events for 'session_start', 'data_transfer', and 'session_end' actions. They currently use `transaction src_ip dst_ip src_port startswith=action=session_start endswith=action=session_end`. However, many transactions are incomplete because some sessions do not have a 'session_end' event due to firewall timeouts. The team wants to include these incomplete sessions as well, but still group them around a start event. What should they modify?

Accepted Answer

Remove endswith and add maxspan=30m. To include incomplete sessions, use `transaction src_ip dst_ip src_port startswith=action=session_start maxspan=30m` without endswith. This will create a transaction starting with session_start and ending after maxspan or if another start event is encountered.

Answer

Add `maxspan=30m` and keep endswith

Answer

Change startswith to `action=session_start OR action=session_end`

Answer

Use `transaction src_ip dst_ip src_port maxspan=30m` without startswith or endswith

Question 10

A financial services company uses Splunk to correlate events from multiple applications. Analysts often use `transaction user_id` to group events, but they notice that this command significantly increases search time and memory usage. After investigating, they find that certain 'user_id' values are extremely frequent (e.g., service accounts) causing huge transactions with thousands of events, which exhaust search memory. The team needs to continue grouping by user_id but must avoid performance issues. They also need to preserve the ability to compute statistics like transaction duration. Which approach best addresses both concerns?

Accepted Answer

Use `transaction user_id maxspan=5m maxevents=100`. Using `transaction user_id maxevents=100 maxspan=5m` limits the size of each transaction, preventing the large transactions. Alternatively, pre-filtering to remove noisy accounts can help, but limiting maxevents is more robust. Option C is the most direct fix.

Answer

Set `maxpause=1m` to break large transactions by gaps

Answer

Exclude service accounts using `where user_id!="svc*"` before transaction

Answer

Switch to `stats values(_raw) by user_id` to avoid transaction overhead

Question 11

A Splunk administrator is tuning a dashboard that uses `transaction` to correlate web server events. The dashboard frequently times out. The admin reviews the search and sees `transaction client_ip maxspan=1h maxpause=30m`. The dataset contains about 10 million events per hour. The admin suspects that the transaction is causing the timeout. Which action should they take to improve performance while still achieving the grouping?

Accepted Answer

Replace transaction with streamstats to create a session ID, then use stats to aggregate. The current transaction has generous limits. Using `transaction` on a large dataset is memory-intensive. A better approach is to pre-aggregate using `stats` or use `streamstats` to compute session boundaries. Option D is the most practical: use `streamstats` to assign session IDs and then use `stats` to group, which is more efficient.

Answer

Add `maxevents=100` to limit events per transaction

Answer

Reduce maxspan to 15m and maxpause to 5m

Answer

Increase the search job concurrency

Question 12

A security analyst is investigating a series of failed login attempts followed by successful logins from the same IP addresses within short time windows. They want to correlate these events into sessions representing potential brute-force attacks. Which TWO statements accurately describe best practices for using the transaction command in this scenario?

Accepted Answer

Transaction command requires at least one field to group events into sessions.. Option A is correct because transaction requires at least one field (like src_ip) to group events into sessions. Option D is correct because startswith and endswith allow defining the boundaries of a transaction, for example, using startswith for failed login and endswith for successful login. Option B is incorrect because transaction events do not need identical timestamps; they can span over time. Option C is incorrect because transaction does not automatically deduplicate events; dedup command would be needed. Option E is incorrect because transaction is not optimized for very long time ranges and can be resource-intensive.

Answer

Transaction command is optimized for correlating events over very long time ranges (over 24 hours).

Answer

Transaction command can only be used with events that have identical timestamps.

Answer

Transaction command automatically deduplicates events within a transaction.

Question 13

A Splunk administrator at a company with 500 employees needs to correlate VPN login events with subsequent network access logs to track user sessions. The VPN logs contain fields: user, src_ip, timestamp, event_type (login or logout). The network logs contain fields: user, dst_ip, timestamp, action (allow or deny). Both logs are indexed daily. The administrator wants to create a search that groups each VPN login with all network access events from that user within the next 8 hours. However, the current search using `transaction user startswith="login" endswith="logout" maxspan=8h` is returning many incomplete transactions where the logout event is missing. What is the most efficient way to improve the correlation without missing sessions?

Accepted Answer

Use `transaction user startswith="login" endswith="logout" maxspan=8h keepevicted=true`.. Option B is correct because adding keepevicted=true will output incomplete transactions (those missing the logout event) as evicted transactions, allowing the analyst to see all sessions, including those where the logout was not recorded. Option A (maxevents=100) may still miss sessions if they don't have a logout. Option C (stats with bucket) does not properly group events into sessions. Option D (removing startswith/endswith) would group all events of the same user within 8 hours, potentially merging separate sessions inaccurately.

Answer

Use a different approach: `... | stats values(*) as * by user, time_bucket | ...` with bucket times.

Answer

Change to `transaction user maxspan=8h` and remove startswith/endswith.

Answer

Use `transaction user maxspan=8h maxevents=100` and filter manually.

Question 14

A financial services company uses Splunk to monitor transactions between internal systems. Each transaction consists of a request event and a response event with identical fields: transaction_id, timestamp, component, status. The request event has component='app' and status='request'; the response event has component='db' and status='success' or 'failure'. The analyst runs the following search to correlate them: `index=main (component=app OR component=db) | transaction transaction_id maxspan=30s`. However, they notice that the search takes too long and often times out when there are many transactions. What change would most effectively reduce search time while still correctly grouping request-response pairs?

Accepted Answer

Use `transaction transaction_id maxevents=2 maxspan=30s`.. Option B is correct because setting maxevents=2 limits each transaction to exactly two events (request and response), preventing large groupings that cause memory issues and timeouts. Option A (stats values) does not maintain event order and may not clearly separate request/response. Option C (smaller time range) is already implied by the maxspan. Option D (rename) does not address the performance issue.

Answer

Use `transaction transaction_id maxspan=30s` with a time range picker to limit the search to a smaller time window.

Answer

Use `stats values(*) as * by transaction_id` and then filter.

Answer

Use `rename component to type` and then use `transaction`.

Question 15

A large e-commerce site logs all user page views and purchases. Each event contains user_id, session_id, timestamp, and event_type (view or purchase). The marketing team wants to analyze the sequence of views that lead to a purchase. They use `transaction session_id startswith="view" endswith="purchase" maxspan=1h`. However, they find that some transactions are missing purchase events because the purchase occurs after 1 hour, or sometimes multiple purchases occur within the same session. To include all related events and correctly identify the sequence leading to each purchase, what is the best approach?

Accepted Answer

Use `stats list(event_type) by session_id` with time sorting to reconstruct the sequence.. Option C is correct because using `stats list(event_type) by session_id` with a sort on timestamp preserves the order of events and handles multiple purchases and variable time spans without the limitations of transaction. Option A (increase maxspan to 24h) would still break on multiple purchases and increase memory usage. Option B (group by user_id) loses session distinction and may merge separate sessions. Option D (keepevicted=true) still requires a start and end for each purchase, missing scenarios where purchase occurs after the window.

Answer

Use `transaction session_id startswith="view" endswith="purchase" maxspan=1h keepevicted=true` to see partial sequences.

Answer

Increase maxspan to 24h to capture all potential purchases.

Answer

Use `transaction user_id maxspan=1h` without startswith/endswith to group all events.