SPLK-1002 Transactions and Event Correlation Practice Test 8 — 15 Questions

Question 1

A search using the transaction command is producing many partial transactions that are closed due to maxpause, but these transactions are often relevant and should not be discarded. Which option should be added to the transaction command to keep these partial results?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

keepevicted=true. The transaction command in Splunk discards partial (evicted) transactions by default, meaning any transaction that exceeds maxspan, maxpause, or maxevents is dropped from the results. Setting keepevicted=true preserves these evicted transactions in the output so they can still be analyzed. Since the question states the partial transactions are relevant and should not be discarded, keepevicted=true is the correct addition.

Answer

keepopen=true

Answer

closed=true

Answer

partial=true

Question 2

A Splunk Power User needs to find the average duration of user sessions. The sessions are defined by a 'user_id' field and have a max inactivity of 15 minutes. Which search correctly calculates this?

Accepted Answer

index=main | transaction user_id maxpause=15m | stats avg(duration). The transaction command with maxpause=15m groups events by user_id into sessions, closing a session when there is a gap of more than 15 minutes between events. The resulting transaction events include a duration field, and stats avg(duration) correctly computes the average session duration.

Answer

index=main | transaction user_id maxpause=15m | eval avg=avg(duration)

Answer

index=main | transaction user_id maxpause=15 | stats avg(_time)

Answer

index=main | transaction user_id maxspan=15m | stats avg(duration)

Question 3

A Splunk search uses 'transaction clientip maxpause=5m'. What does the maxpause setting control?

Accepted Answer

The maximum time gap between events in the transaction.. The maxpause parameter in the transaction command specifies the maximum time gap allowed between consecutive events in a transaction. If the time between two events exceeds maxpause, the transaction is closed and a new one begins.

Answer

The maximum number of transactions allowed.

Answer

The maximum number of events in the transaction.

Answer

The maximum total time span of the transaction.

Question 4

An analyst wants to group events from different sourcetypes (web_access and error_log) into a single transaction when they share the same 'request_id' field and occur within 1 minute. Which search correctly accomplishes this?

Accepted Answer

(sourcetype=web_access OR sourcetype=error_log) | transaction request_id maxspan=1m. Using OR to combine sourcetypes and then transaction with maxspan=1m groups events by request_id across both sourcetypes, with a total time limit of 1 minute.

Answer

index=* | transaction request_id maxspan=1m

Answer

index=main | join type=inner request_id [search sourcetype=error_log]

Answer

sourcetype=web_access | transaction request_id maxspan=1m | append [search sourcetype=error_log | transaction request_id maxspan=1m]

Question 5

A search includes 'transaction userid maxspan=1h maxopentxn=1000'. What is the purpose of maxopentxn?

Accepted Answer

It limits the number of transactions that can be open simultaneously in memory.. The maxopentxn parameter in the transaction command specifies the maximum number of open transactions that Splunk will keep in memory at any given time during the transaction grouping process. When this limit is reached, Splunk will close the oldest open transactions to free up memory, ensuring that the search does not consume excessive resources. This is particularly important when dealing with large datasets where many transactions might be open concurrently, as it prevents memory exhaustion and maintains search performance.

Answer

It limits the total number of transactions in the search results.

Answer

It limits the number of events per transaction.

Answer

It limits the time span of open transactions.

Question 6

Which TWO fields are automatically created by the transaction command? (Select exactly 2 correct answers.)

Accepted Answer

_endtime. The transaction command automatically creates the _starttime and _endtime fields for each transaction, which record the timestamp of the earliest and latest events in the group respectively; these are essential for measuring transaction duration and are added without any explicit configuration. Option B (_endtime) is correct because it captures the time of the last event in the transaction, and option C (_starttime) is correct because it captures the time of the first event. Option A (total_events) is not automatically created by transaction — it would require an explicit eval or stats count. Option D (_time) is a default field present on all events, not something transaction creates. Option E (maxpause) is a transaction command argument that limits the maximum time between events, not an output field.

Answer

total_events

Answer

_time

Answer

maxpause

Question 7

Which THREE strategies can help reduce memory usage when using the transaction command? (Select exactly 3 correct answers.)

Accepted Answer

Filter events before the transaction command.. Option A is correct because filtering events with a search or where clause before the transaction command means fewer events enter the transaction state, directly lowering the memory the command must hold. Option B is correct because maxspan and maxpause bound how far apart and how long events can be grouped; smaller values cause transactions to close sooner, so fewer events are retained in memory at once. Option C is correct because using fields (or table) to keep only the needed fields before transaction reduces the per-event payload stored in memory, cutting overall memory usage. Option D is not correct because keepevicted=true retains evicted (incomplete) transactions, which increases rather than reduces memory consumption. Option E is not correct because increasing maxopentxn allows more concurrently open transactions, which raises memory usage instead of lowering it.

Answer

Use keepevicted=true.

Answer

Increase maxopentxn.

Question 8

Refer to the exhibit. What is the purpose of the 'maxpause=5m' parameter in this search?

Accepted Answer

It closes the transaction if there is no new event from the same clientip within 5 minutes.. maxpause sets the inactivity timeout: if no new event from the same clientip arrives within 5 minutes, the transaction is closed.

Answer

It limits the number of events in a transaction to 5.

Answer

It limits the total time span of each transaction to 5 minutes.

Answer

It pauses the search for 5 minutes between transactions.

Question 9

Refer to the exhibit. What is the purpose of this configuration?

Accepted Answer

It defines a transaction type that can be used in search with `transaction mytransaction` to group events by clientip and userid with given time parameters.. The configuration shown is a saved transaction definition in Splunk's transactiontypes.conf (or defined via Settings > Transaction types). It specifies fields (clientip, userid) and time parameters (maxspan, maxpause, etc.) that will be applied when the transaction type is invoked by name in a search using `transaction mytransaction`. This allows reusable, consistent grouping logic without retyping parameters each time.

Answer

It creates a search-time field extraction for clientip and userid.

Answer

It configures the transaction command to run automatically on all data.

Answer

It defines a transaction type that can be used in search with `transaction mytransaction` to group events by clientip and userid, ignoring the specified time parameters.

Question 10

An analyst uses transaction to group web requests by session_id. Some transactions are unexpectedly large, containing hundreds of events. What parameter should be adjusted to limit the number of events per transaction?

Accepted Answer

maxevents. The maxevents parameter in the transaction command limits the maximum number of events that can be included in a single transaction. Setting it to a lower value prevents transactions from growing too large and consuming excessive memory.

Answer

maxspan

Answer

maxpause

Answer

mvcount

Question 11

An analyst wants to ensure that a transaction is only considered complete when it contains a specific end event. Which transaction parameter should be used?

Accepted Answer

endswith. The endswith parameter tells the transaction command which event marks the end of a transaction, so a transaction is only closed when an event matching that value is found. In the login/logout example, endswith="LOGOUT" ensures the transaction is not considered complete until a LOGOUT event arrives. This is the correct parameter for defining the terminating event.

Answer

startswith

Answer

maxpause

Answer

maxspan

Question 12

An analyst wants to find transactions where the first event was a 'login' and the last event was a 'logout'. Which post-transaction filter is correct?

Accepted Answer

where mvindex(action,0)="login" AND mvindex(action,-1)="logout". The [CORRECT] answer uses mvindex(), which is the Splunk multivalue function designed to retrieve a specific element from a multivalue field by its position. In Splunk's transaction command, the action field becomes a multivalue field where events are ordered chronologically, so mvindex(action, 0) returns the first event's action and mvindex(action, -1) returns the last event's action (negative indices count from the end). This correctly filters transactions where the first event is 'login' and the last is 'logout'.

Answer

where action[0]="login" AND action[-1]="logout"

Answer

where first(action)="login" AND last(action)="logout"

Answer

where action="login" AND action="logout"

Question 13

A transaction search that uses a large maxspan and high-cardinality fields is failing due to memory limitations. Which approach can best reduce memory usage without changing the transaction logic?

Accepted Answer

Use the 'fields' command before transaction to retain only the correlation fields and _time.. Using the 'fields' command before 'transaction' to retain only the correlation fields and _time reduces the amount of data carried through the transaction processing pipeline. The transaction command must hold events in memory to group them, so limiting the fields reduces memory footprint without altering the grouping logic. This is the most direct way to address memory limitations while preserving transaction semantics.

Answer

Use the 'stats' command with values() instead of transaction.

Answer

Increase the maxpause value to reduce number of open transactions.

Answer

Set keepevicted=true to offload evicted events.

Question 14

An analyst wants to group events by 'session_id' but only if the events occur within 5 minutes of each other, and there must be at least 2 events per transaction. Which transaction parameters achieve this?

Accepted Answer

transaction session_id maxpause=300 minevents=2. Maxpause=300 ensures events are within 5 minutes of each other, and minevents=2 ensures at least 2 events. Option A (maxspan=300) only limits total time. Option B (maxevents=2) limits event count but not grouping window. Option D (minpause) is not a valid parameter.

Answer

transaction session_id maxspan=300

Answer

transaction session_id maxspan=300 maxevents=2

Answer

transaction session_id maxspan=300 minpause=300

Question 15

Which three statements about the transaction command are correct? (Choose three.)

Accepted Answer

The transaction command automatically adds an 'eventcount' field.. Option A is correct because the transaction command automatically adds an eventcount field that records how many events were grouped into each transaction. Option D is correct because transaction also automatically adds a duration field showing the elapsed time between the first and last event of the transaction. Option E is correct because transaction can correlate events across different indexes, sourcetypes, and hosts as long as the grouping fields match. Option B is incorrect because startswith and endswith are optional parameters used to define transaction boundaries, not required ones. Option C is incorrect because transaction is not limited to a single sourcetype; it can group events from multiple sourcetypes.

Answer

The transaction command requires a startswith or endswith parameter.

Answer

The transaction command can only correlate events within the same sourcetype.