SPLK-1002 Transactions and Event Correlation Practice Test 8 — 15 Questions

Question 1

A company has events from multiple data sources that share a common 'request_id'. They want to correlate events from different sources (e.g., web, app, database) into a single transaction per request. However, the timestamps across sources are not synchronized, causing some events to appear out of order. Which approach is best to ensure correct grouping?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use `sort _time | transaction request_id maxspan=10m`. Setting a larger maxspan and using `sort _time` before transaction can help reorder events, but the most reliable method is to use `transaction request_id` with a generous maxspan and, if needed, use `sort 0 _time` before transaction to ensure time order.

Answer

Use `eventstats count by request_id` to correlate counts

Answer

Use `transaction request_id` and rely on Splunk to automatically reorder

Answer

Use `transaction request_id maxspan=1m` and ignore out-of-order events

Question 2

A user wants to see a single consolidated event for each user session that includes the start time, end time, and total duration. The session events have a 'action' field with values 'start' and 'end' and a common 'user_id'. Which transaction command would achieve this?

Accepted Answer

`transaction user_id startswith=action=start endswith=action=end`. Using startswith and endswith defines the boundary events, and transaction automatically calculates duration when there are start and end events.

Answer

`transaction startswith=action=start endswith=action=end`

Answer

`transaction user_id`

Answer

`stats values(action) by user_id`

Question 3

A search uses `transaction session_id maxspan=30m` to group events. The search returns 5000 transaction events. The analyst needs to filter out any transaction that does not contain an event with status=failure. Which post-transaction command should be used?

Accepted Answer

`| transaction session_id maxspan=30m | search status=failure`. After transaction, you can use `where` with a subsearch or use `search` to filter based on fields within the transaction. Specifically, `search` can be used after transaction to filter events that contain a certain field-value pair.

Answer

`| transaction session_id maxspan=30m | stats count(eval(status="failure")) by session_id`

Answer

`| transaction session_id maxspan=30m | where status=failure`

Answer

`| transaction session_id maxspan=30m | eval has_failure=if(match(_raw, "failure"),1,0) | where has_failure=1`

Question 4

An analyst writes `transaction client_ip` to group events from a firewall. The resulting transactions show many events with duration=0. What is the most likely cause?

Accepted Answer

There is only one event per client_ip in the time range. A duration of 0 often occurs when there is only one event in the transaction. This can happen if the events do not meet the criteria for starting or ending a transaction, or if the maxpause is too short.

Answer

The client_ip field contains duplicates

Answer

The transaction option maxspan is set too high

Answer

The events are not time-stamped properly

Question 5

Which TWO options can be used with the `transaction` command to control how many events are included in a single transaction?

Accepted Answer

maxspan. maxevents limits the number of events per transaction. maxspan limits the time span, indirectly limiting events. maxpause limits the pause between events.

Answer

mvcount

Answer

maxpause

Answer

keepevicted

Question 6

Which THREE statements about the `transaction` command are true?

Accepted Answer

Transaction can correlate events based on more than one field.. The `transaction` command groups events based on one or more fields (option A true). It can include multivalue fields from constituent events (B true). The `maxpause` option sets the maximum pause between events, not the total time span; the `maxtime` option sets the maximum time span (so C false). When using `startswith` and `endswith`, a `duration` field is added (D true). Transaction is memory-intensive and not recommended for large datasets, making E false. Therefore, the correct options are A, B, and D.

Answer

The maxpause option sets the maximum time span of the transaction.

Answer

Transaction is the most efficient way to group events from large datasets.

Question 7

Which TWO options can be used with the `transaction` command to define the beginning and end of a transaction?

Accepted Answer

endswith. startswith and endswith define boundary events. maxspan and maxpause are constraints.

Answer

closed_txn

Answer

maxpause

Answer

maxspan

Question 8

A large e-commerce company is using Splunk to monitor user sessions across multiple microservices. Each service logs events with a common 'session_id' field. The security team wants to identify sessions where a user performed a 'password_change' action followed by a 'login' from a different IP address within 5 minutes, indicating possible account takeover. The current search uses `transaction session_id startswith=action=login endswith=action=password_change maxspan=10m`. However, the search returns very few results, and the team suspects it is missing many attacks. The logs show that sometimes 'password_change' occurs before 'login' (e.g., password reset then login) and the IP changes are observed across multiple events. The team needs to capture both orderings. Which approach should they take?

Accepted Answer

Use `transaction session_id maxspan=5m` and then filter for sessions that contain both actions. The current search only captures one order (login then password_change). To capture both orders, they should either use `transaction session_id maxspan=5m` without startswith/endswith and then filter, or use two separate transactions and combine. The best option is to use `transaction session_id maxspan=5m` and then search for events where both actions occur, because it avoids order dependency and is simpler.

Answer

Use `transaction session_id startswith=action=password_change endswith=action=login maxspan=5m` in a separate search and append results

Answer

Keep the current search but increase maxspan to 30m

Answer

Add both startswith and endswith with OR conditions: `startswith=(action=login OR action=password_change) endswith=(action=login OR action=password_change)`

Question 9

A network operations team monitors firewall logs using Splunk. They need to group events from the same TCP session, identified by 'src_ip', 'dst_ip', and 'src_port'. The logs contain events for 'session_start', 'data_transfer', and 'session_end' actions. They currently use `transaction src_ip dst_ip src_port startswith=action=session_start endswith=action=session_end`. However, many transactions are incomplete because some sessions do not have a 'session_end' event due to firewall timeouts. The team wants to include these incomplete sessions as well, but still group them around a start event. What should they modify?

Accepted Answer

Remove endswith and add maxspan=30m. To include incomplete sessions without an 'session_end' event, remove the `endswith` clause and add a `maxspan` time limit. This ensures that transactions are automatically closed after the specified time (30 minutes) if no end event is encountered. The `startswith` clause remains to initiate transactions only on 'session_start' events. Option B correctly implements this: `transaction src_ip dst_ip src_port startswith=action=session_start maxspan=30m`. This way, sessions that timeout are still captured as transactions.

Answer

Add `maxspan=30m` and keep endswith

Answer

Change startswith to `action=session_start OR action=session_end`

Answer

Use `transaction src_ip dst_ip src_port maxspan=30m` without startswith or endswith

Question 10

A financial services company uses Splunk to correlate events from multiple applications. Analysts often use `transaction user_id` to group events, but they notice that this command significantly increases search time and memory usage. After investigating, they find that certain 'user_id' values are extremely frequent (e.g., service accounts) causing huge transactions with thousands of events, which exhaust search memory. The team needs to continue grouping by user_id but must avoid performance issues. They also need to preserve the ability to compute statistics like transaction duration. Which approach best addresses both concerns?

Accepted Answer

Use `transaction user_id maxspan=5m maxevents=100`. The correct approach is to use `transaction user_id maxspan=5m maxevents=100`. This limits each transaction to a maximum of 100 events within a 5-minute window, preventing huge transactions from service accounts while still allowing grouping by user_id and computation of statistics like duration. Option B directly addresses both concerns without excluding data. Pre-filtering (option C) removes data, which may lose needed events or skew results, and is less robust than bounding transaction size.

Answer

Set `maxpause=1m` to break large transactions by gaps

Answer

Exclude service accounts using `where user_id!="svc*"` before transaction

Answer

Switch to `stats values(_raw) by user_id` to avoid transaction overhead

Question 11

A Splunk administrator is tuning a dashboard that uses `transaction` to correlate web server events. The dashboard frequently times out. The admin reviews the search and sees `transaction client_ip maxspan=1h maxpause=30m`. The dataset contains about 10 million events per hour. The admin suspects that the transaction is causing the timeout. Which action should they take to improve performance while still achieving the grouping?

Accepted Answer

Replace transaction with streamstats to create a session ID, then use stats to aggregate. The transaction command is memory-intensive, especially with a large dataset (10 million events per hour) and generous limits (maxspan=1h, maxpause=30m). To improve performance, a more efficient approach is to use streamstats to generate a session ID based on a timeout (e.g., using the time difference between events) and then use stats to group by that ID. This avoids holding all events in memory and processes events in a streaming manner. Option A correctly suggests this method. Option B (maxevents=100) still uses transaction and may truncate valid sessions. Option C reduces limits but may miss legitimate sessions and still uses transaction. Option D increases search job concurrency but does not address the underlying memory issue.

Answer

Add `maxevents=100` to limit events per transaction

Answer

Reduce maxspan to 15m and maxpause to 5m

Answer

Increase the search job concurrency

Question 12

A security analyst is investigating a series of failed login attempts followed by successful logins from the same IP addresses within short time windows. They want to correlate these events into sessions representing potential brute-force attacks. Which TWO statements accurately describe best practices for using the transaction command in this scenario?

Accepted Answer

Transaction command requires at least one field to group events into sessions.. The transaction command requires at least one field (like src_ip) to group events into sessions; without a grouping field, events cannot be correlated. Option C is correct because the transaction command can define transaction boundaries using startswith and endswith conditions, enabling detection of a sequence like failed login followed by successful login. Option A is incorrect because transaction is not optimized for very long time ranges; it can be resource-intensive and is better suited for shorter windows. Option D is incorrect because transaction does not require identical timestamps; events can span time. Option E is incorrect because transaction does not automatically deduplicate events; you would need the dedup command for that.

Answer

Transaction command is optimized for correlating events over very long time ranges (over 24 hours).

Answer

Transaction command can only be used with events that have identical timestamps.

Answer

Transaction command automatically deduplicates events within a transaction.

Question 13

A Splunk administrator at a company with 500 employees needs to correlate VPN login events with subsequent network access logs to track user sessions. The VPN logs contain fields: user, src_ip, timestamp, event_type (login or logout). The network logs contain fields: user, dst_ip, timestamp, action (allow or deny). Both logs are indexed daily. The administrator wants to create a search that groups each VPN login with all network access events from that user within the next 8 hours. However, the current search using `transaction user startswith="login" endswith="logout" maxspan=8h` is returning many incomplete transactions where the logout event is missing. What is the most efficient way to improve the correlation without missing sessions?

Accepted Answer

Use `transaction user startswith="login" endswith="logout" maxspan=8h keepevicted=true`.. Adding keepevicted=true to the transaction command causes Splunk to output incomplete transactions (those missing the logout event) as evicted transactions. This allows the analyst to see all sessions, including those where the logout was not recorded, preventing missing data. Option A uses stats with time buckets, which does not properly group events into sessions. Option B removes startswith and endswith, so it would group all events of the same user within 8 hours, potentially merging separate sessions inaccurately. Option D uses maxevents=100, which may still drop sessions if they have many events, and manual filtering is inefficient.

Answer

Use a different approach: `... | stats values(*) as * by user, time_bucket | ...` with bucket times.

Answer

Change to `transaction user maxspan=8h` and remove startswith/endswith.

Answer

Use `transaction user maxspan=8h maxevents=100` and filter manually.

Question 14

A financial services company uses Splunk to monitor transactions between internal systems. Each transaction consists of a request event and a response event with identical fields: transaction_id, timestamp, component, status. The request event has component='app' and status='request'; the response event has component='db' and status='success' or 'failure'. The analyst runs the following search to correlate them: `index=main (component=app OR component=db) | transaction transaction_id maxspan=30s`. However, they notice that the search takes too long and often times out when there are many transactions. What change would most effectively reduce search time while still correctly grouping request-response pairs?

Accepted Answer

Use `transaction transaction_id maxevents=2 maxspan=30s`.. Adding `maxevents=2` limits each transaction to exactly two events (a request and a response), preventing large groupings that cause memory issues and timeouts. The `maxspan=30s` already sets a time window. Option A (using a time range picker) does not address the internal grouping inefficiency. Option B (`stats values(*) as * by transaction_id`) does not maintain event order and can mix fields, failing to properly correlate request-response pairs. Option C (renaming component to type) does not improve performance.

Answer

Use `transaction transaction_id maxspan=30s` with a time range picker to limit the search to a smaller time window.

Answer

Use `stats values(*) as * by transaction_id` and then filter.

Answer

Use `rename component to type` and then use `transaction`.

Question 15

A large e-commerce site logs all user page views and purchases. Each event contains user_id, session_id, timestamp, and event_type (view or purchase). The marketing team wants to analyze the sequence of views that lead to a purchase. They use `transaction session_id startswith="view" endswith="purchase" maxspan=1h`. However, they find that some transactions are missing purchase events because the purchase occurs after 1 hour, or sometimes multiple purchases occur within the same session. To include all related events and correctly identify the sequence leading to each purchase, what is the best approach?

Accepted Answer

Use `stats list(event_type) by session_id` with time sorting to reconstruct the sequence.. Using `stats list(event_type) by session_id` with a sort on timestamp preserves the order of events and handles multiple purchases and variable time spans without the limitations of the transaction command. Option B (keepevicted=true) still requires a start and end for each purchase, missing scenarios where purchase occurs after the window. Option C (increase maxspan to 24h) would still break on multiple purchases and increase memory usage. Option D (group by user_id) loses session distinction and may merge separate sessions.

Answer

Use `transaction session_id startswith="view" endswith="purchase" maxspan=1h keepevicted=true` to see partial sequences.

Answer

Increase maxspan to 24h to capture all potential purchases.

Answer

Use `transaction user_id maxspan=1h` without startswith/endswith to group all events.