SPLK-1002 Transactions and Event Correlation — Timed 100 Questions

Question 1

A Splunk administrator notices that the 'transaction' command is consuming excessive memory when processing a large dataset. The dataset contains events with a common field 'user_id', and the goal is to group events per user within 1 hour. Which approach would best reduce memory usage while still achieving the desired correlation?

100 minute time limit — choose an answer to begin.

Accepted Answer

Use a subsearch to first filter events and then apply transaction on the smaller set.. Using a subsearch first reduces the dataset size before the 'transaction' command processes it, directly addressing the memory issue. The 'transaction' command groups events into memory until they are finalized, so a smaller input set means fewer events held simultaneously, lowering memory consumption while still allowing the 1-hour maxspan correlation per user_id.

Answer

Use the 'kvform' command instead of transaction.

Answer

Add more fields to the transaction to make it more specific.

Answer

Increase the maxspan value to 2 hours to reduce the number of transactions.

Question 2

A Splunk administrator is troubleshooting a slow search that uses the transaction command. The search correlates events by 'user_uuid' with a maxspan of 1 hour. The administrator suspects that many orphan events (events that never complete a transaction) are causing performance issues. Which approach can help identify and possibly exclude orphan events from the transaction?

Accepted Answer

Use the 'keepevicted=true' option and then filter out evicted events in a subsequent search.. The `keepevicted=true` parameter causes the `transaction` command to output events that were evicted from the transaction window (orphans) with an `evicted` field set to 1. You can then filter out these evicted events in a subsequent search using `where evicted=0`, which isolates only complete transactions and removes the performance overhead of orphan events.

Answer

Increase maxspan to allow more events to complete.

Answer

Use the 'mvlist' option to list all user_uuid values.

Answer

Add 'closed_txn=1' to the transaction command to only output complete transactions.

Question 3

A Splunk user needs to correlate events from different sourcetypes (web_access, auth_log, app_log) that share a common 'transaction_id' field. Each transaction_id may appear many times across sourcetypes. The user wants to group all events with the same transaction_id into one transaction, without any time constraints. Which transaction command is most appropriate?

Accepted Answer

transaction by transaction_id. Intended to be A, but note that in Splunk, the `transaction` command does not use a `by` clause; the correct syntax is `transaction transaction_id`. However, among the given options, option A is the only one that groups by `transaction_id` without imposing any time constraints (like `maxspan`) or marker arguments (`startswith`/`endswith`). Option B incorrectly includes `sourcetype` in the grouping, which would split events across sourcetypes. Option C adds a time constraint (`maxspan=1d`) which is not required. Option D adds marker arguments that are not needed. Therefore, despite the syntactical inaccuracy, option A is the most appropriate choice.

Answer

transaction by sourcetype transaction_id

Answer

transaction maxspan=1d by transaction_id

Answer

transaction startswith=* endswith=* by transaction_id

Question 4

Which TWO statements about the 'transaction' command are correct? (Choose two.)

Accepted Answer

It can use the 'by' clause to group events based on common field values.. Option C is correct because the transaction command supports a 'by' clause (e.g., transaction by user_id) that groups related events sharing common field values into the same transaction. Option E is correct because transaction's core purpose is to merge multiple related events into a single combined event, joining their fields and preserving the raw events. Option A is incorrect because transaction does not require events to come from the same source; it can group events across different sources or hosts. Option B is incorrect because transaction does not sum numeric field values; that is the role of stats sum() or addtotals. Option D is incorrect because maxevents limits the number of events per transaction, not the total number of transactions output (that would be maxopentxn or similar constraints).

Answer

It requires all events to be from the same source.

Answer

It sums numeric field values across events in the transaction.

Answer

The 'maxevents' option limits the total number of transactions output.

Question 5

Which THREE conditions must be met for events to be grouped into the same transaction when using the 'transaction' command without any 'startswith' or 'endswith' options? (Choose three.)

Accepted Answer

Events must have the same value in the field specified by the 'by' clause.. When the transaction command is used without startswith or endswith, grouping is driven by the by clause, maxspan, and maxpause. Option A is correct because events are only grouped together if they share the same value in the field named by the by clause, which defines the transaction boundaries. Option B is correct because maxspan sets the maximum allowed time between the first and last event in a transaction, so the total span must not exceed that value. Option D is correct because maxpause limits the maximum time gap between consecutive events, and any larger gap breaks the transaction. Option C is not required, since transactions can span different sourcetypes as long as the by, maxspan, and maxpause conditions are satisfied. Option E is not required, because Splunk assigns timestamps to events and does not require a special chronological or no-missing-timestamp condition for transaction grouping.

Answer

Events must be from the same sourcetype.

Answer

Events must appear in chronological order with no missing timestamps.

Question 6

Refer to the exhibit. A Splunk user runs the search shown. The search returns results, but the user notices that some clientip values appear multiple times in the stats output, even though they should have been grouped into a single transaction. What is the most likely reason for this?

Accepted Answer

The maxevents option prevents more than 5 events from being grouped into one transaction, so additional events form separate transactions.. The `transaction` command's `maxevents` option limits the maximum number of events that can be grouped into a single transaction. When more than 5 events exist for a given `clientip`, the extra events cannot be included in the first transaction and instead form separate transactions, causing the same `clientip` to appear multiple times in the `stats` output.

Answer

The sourcetype filter is excluding some events.

Answer

The stats command is not correctly summing the counts.

Answer

The maxspan is too short to capture all events for each clientip.

Question 7

A security team wants to detect a multi-step attack pattern: a user logs in from a new IP address, then within 10 minutes performs a privilege escalation, and finally accesses a sensitive file. They have events with fields: user, ip, action, and timestamp. Which SPL transaction statement should they use to group these three events into one transaction, ensuring all three actions occur in order?

Accepted Answer

`transaction user maxspan=10m`. `transaction user maxspan=10m` groups all events from the same user that occur within a 10-minute window. The events are inherently ordered by timestamp, so the three actions (login, privilege escalation, sensitive file access) will appear in chronological order within the transaction, satisfying the requirement. Including `action` or `ip` in the transaction fields would split the three different actions or IP addresses into separate transactions, preventing detection of the complete pattern.

Answer

`transaction user,ip,action maxspan=10m`

Answer

`transaction user maxpause=30s`

Answer

`transaction user mvcount=3`

Question 8

A Splunk user wants to correlate events from different sourcetypes (web_access, app_log) that belong to the same user session identified by session_id. The events should be grouped only if they occur within 30 minutes of each other, and each transaction should contain at least one event from each sourcetype. Which SPL construct should they use?

Accepted Answer

`transaction session_id maxspan=30m`. The `transaction` command groups events that share a common field (`session_id`) and allows you to set constraints like `maxspan=30m` to limit the time window between the first and last event in the transaction. However, `transaction` does not automatically require events from both sourcetypes; grouping is based solely on the session_id field. To ensure each transaction contains at least one event from both `web_access` and `app_log`, you would need to add a subsequent filter, such as `| where mvcount(sourcetype) > 1`. Nevertheless, option B is the correct construct because it groups events by session_id within the time window, and the additional requirement can be applied afterward. The other options fail to enforce the 30-minute window or the presence of both sourcetypes.

Answer

`append [search sourcetype=app_log]` then sort by session_id

Answer

`sourcetype=web_access OR sourcetype=app_log | eval session=session_id` then `stats values(*) as * by session`

Answer

`join type=inner session_id [search sourcetype=app_log]` after a search on web_access

Question 9

Which TWO statements are true about the `transaction` command in Splunk?

Accepted Answer

It can group events based on one or more common field values.. The `transaction` command groups events based on common field values (A) and supports options like maxspan and maxpause to define time boundaries (D). It also automatically adds a `duration` field calculated as the time difference between the first and last event in each transaction (B), and within each transaction, events are automatically sorted by _time in chronological order (E). Option C is false because transaction can correlate events across different sourcetypes if they share common fields.

Answer

It can only correlate events from the same sourcetype.

Question 10

Which THREE of the following are valid use cases for the `transaction` command in Splunk?

Accepted Answer

Identifying a sequence of events that indicate a brute-force attack (multiple failed logins followed by a success).. Option A is correct because transaction is designed to group related events by fields such as src_ip and can enforce an ordered sequence with startswith/endswith (e.g., failed login then success), which is exactly how a brute-force pattern is detected. Option C is correct because transaction can group events sharing a common identifier like session ID or user across multiple web servers, joining them into a single correlated transaction spanning hosts. Option E is correct because transaction can correlate a customer's browsing events with a later purchase event using a shared customer/session key, enabling conversion-rate analysis. Option B is not a valid use case because counting events within a transaction is done with the where clause on eventcount (e.g., ... | where eventcount > 5) or with stats, not by transaction itself. Option D is not a valid use case because enriching events with external CSV data is performed with lookup, not transaction.

Answer

Generating an alert when a transaction contains more than five events.

Answer

Enriching events with external data from a CSV file based on a common key.

Question 11

Refer to the exhibit. The search is intended to count the number of clients who made more than 3 HTTP requests within any 30-minute window. However, the results are unexpectedly high. What is the most likely reason?

Accepted Answer

The same clientip can appear in multiple transactions, causing overcounting.. The transaction command groups events into transactions based on fields like clientip. If the same clientip appears in multiple transactions (e.g., because the 30-minute window resets or overlaps), that clientip will be counted multiple times in the final stats count. This overcounting inflates the result, making it unexpectedly high.

Answer

The sourcetype does not contain enough methods to satisfy the condition.

Answer

The stats command should use `dc(clientip)` instead of `count by clientip`.

Answer

The mvcount function counts the number of unique methods, not events.

Question 12

Refer to the exhibit. The search aims to detect brute-force attacks where there are at least 2 failed logins followed by a successful login from the same source IP within 5 minutes. However, the search returns no results even though such attacks exist. What is the most likely error in the search logic?

Accepted Answer

The `search stage="*"` command is filtering out all transactions because stage is a multivalue field.. The `search stage="*"` command filters out all transactions because `stage` is a multivalue field created by the `transaction` command. In Splunk, a multivalue field cannot be matched with a simple wildcard search like `stage="*"`; this search only returns events where `stage` is a single literal asterisk. To search for any value in a multivalue field, you must use `mvcount(stage)>0` or `search stage=*` (without quotes).

Answer

The transaction should group by user instead of src.

Answer

The case statement does not set stage for events that don't match either pattern.

Answer

The mvcount(stage) condition is incorrectly checking for >2 and >=2 simultaneously.

Question 13

A security team needs to correlate failed login attempts across multiple web servers to identify brute force attacks. Each server logs authentication failures with timestamps and source IPs. The team wants to create a transaction that groups failed attempts within 5 minutes from the same IP, but only if there are at least 3 failures. Which approach correctly implements this requirement?

Accepted Answer

index=web sourcetype=access_combined status=401 | transaction clientip maxspan=5m. Uses the `transaction` command with `maxspan=5m` to group events by `clientip` within a 5-minute window, capturing all failed attempts. To enforce the requirement of at least 3 failures, you would add a filter like `where mvcount(_raw) >= 3` after the transaction. Among the given options, D is the closest because it creates the necessary time-based grouping without incorrectly capping the number of events per transaction (as Option B does with `maxevents=3`, which sets a maximum, not a minimum).

Answer

index=web sourcetype=access_combined status=401 | search clientip=* | head 3

Answer

index=web sourcetype=access_combined status=401 | transaction clientip maxspan=5m maxevents=3

Answer

index=web sourcetype=access_combined status=401 | stats count by clientip, _time

Question 14

A Splunk administrator notices that a `transaction` command used for correlating VPN login and logout events is consuming excessive memory and causing search timeouts. The transaction groups events by `user` with `maxspan=12h` and `maxpause=30m`. The VPN logs contain millions of events per day. Which design change would most effectively reduce resource consumption while maintaining the ability to correlate logins and logouts within the same session?

Accepted Answer

Replace the transaction command with a stats command using earliest and latest functions on the event type.. Replacing `transaction` with `stats` using `earliest` and `latest` eliminates the in-memory event buffering that causes memory exhaustion. `transaction` holds all events in memory until the transaction boundary (maxspan/maxpause) is reached, which is extremely expensive for millions of VPN events. `stats` processes events in a streaming fashion, computing the first and last timestamps per user without storing the full event list, drastically reducing memory and avoiding timeouts.

Answer

Remove the maxpause option from the transaction command to simplify grouping.

Answer

Reduce maxspan to 4h to limit the time window for grouping events.

Answer

Add maxevents=2 to the transaction command to limit each transaction to exactly two events.

Question 15

An analyst wants to correlate events from two different sourcetypes: `auth` logs (login events) and `app` logs (application actions). Both logs share a common `session_id` field. The analyst needs to group all events from the same session, regardless of sourcetype, with a maximum time span of 1 hour. Which search correctly uses the `transaction` command?

Accepted Answer

index=main (sourcetype=auth OR sourcetype=app) | transaction session_id maxspan=1h. The `transaction` command groups events that share a common `session_id` field, and the `maxspan=1h` parameter restricts the transaction to a maximum time span of 1 hour. The syntax `transaction session_id maxspan=1h` is valid and ensures all events from both sourcetypes (`auth` and `app`) are correlated into sessions based on the shared field, regardless of sourcetype.

Answer

index=main (sourcetype=auth OR sourcetype=app) | transaction by session_id maxspan=1h

Answer

index=main (sourcetype=auth OR sourcetype=app) | stats values(*) by session_id, _time

Answer

index=main sourcetype=auth | append [search index=main sourcetype=app] | transaction session_id maxspan=1h

Question 16

A security analyst is writing a search to detect lateral movement across servers by correlating authentication events from multiple domain controllers. Each event has a `user`, `src_ip`, and `dest_ip`. The analyst wants to group events where the same user authenticates from at least 3 different source IPs within 10 minutes. Which TWO components must be part of the search to achieve this? (Choose TWO.)

Accepted Answer

Use `transaction user` to group events by user.. Option A is correct because `transaction user` groups all authentication events sharing the same `user` value into a single transaction, which is exactly the grouping the analyst needs to correlate events per user across domain controllers. Option C is correct because `maxspan=10m` constrains each transaction to events occurring within a 10-minute window, matching the requirement that the 3 distinct source IPs appear within 10 minutes. Option B is not marked correct: `mvcount(src_ip)>=3` counts all values including duplicates, so it would not reliably enforce 3 *distinct* source IPs (and the required distinctness would need `dc(src_ip)>=3` or similar). Option D is wrong because `maxevents=3` caps the number of events per transaction rather than ensuring at least three distinct source IPs. Option E is wrong because `dedup user` would collapse events to one per user before the transaction, destroying the multiple source IP evidence needed for the correlation.

Answer

After the transaction, use `where mvcount(src_ip)>=3` to filter transactions with at least 3 distinct source IPs.

Answer

Use `maxevents=3` to ensure at least three events per transaction.

Answer

Use `dedup user` before the transaction to reduce events.

Question 17

A large e-commerce company uses Splunk to monitor its web application performance. The application logs every HTTP request with fields: `transaction_id`, `url`, `response_time_ms`, `status`. Currently, the team uses the following search to identify slow page loads:

`index=web sourcetype=access_combined | transaction transaction_id maxspan=60s | eval total_time = sum(response_time_ms) | where total_time > 5000`

However, the search returns no results even though there are known slow pages. The team verified that logs contain `transaction_id` values and that some pages take over 10 seconds. What is the most likely reason the search fails to identify slow pages?

Accepted Answer

The `eval total_time = sum(response_time_ms)` is incorrect because after `transaction`, `response_time_ms` is a multivalue field, and `sum()` does not automatically calculate the sum of multivalue fields.. After the `transaction` command, `response_time_ms` becomes a multivalue field containing all the individual response times from the events in the transaction. The `sum()` function in `eval` does not automatically aggregate multivalue fields; it requires explicit use of the `mvsum()` function or a `stats sum()` approach. Without this, `total_time` is not calculated correctly, so the `where` clause never matches, returning no results despite slow pages existing.

Answer

The `maxspan=60s` is too short; some page loads may take longer than 60 seconds, causing incomplete transactions.

Answer

The `transaction` command is grouping by `transaction_id`, but the events might have different transaction_id values for the same page load.

Answer

The field name is misspelled; it should be `response_time` not `response_time_ms`.

Question 18

A financial services company uses Splunk to detect fraudulent transactions. Each transaction event has fields: `user_id`, `amount`, `merchant`, `timestamp`. The fraud detection team wants to identify users who make multiple small transactions (under $50) totaling over $200 within a 1-hour window, which may indicate testing stolen credit cards. They write the following search:

`index=transactions sourcetype=payment amount<50 | transaction user_id maxspan=1h | where sum(amount) > 200`

This search runs but returns no results, even though manual inspection shows users with such patterns. What is the primary reason the search fails?

Accepted Answer

The `where sum(amount) > 200` does not work as expected because `sum()` is not an aggregation function in that context; you need to use `stats sum(amount)` or `eval total=mvsum(amount)` first.. The `transaction` command creates a single multivalue field `amount` containing all amounts from the grouped events. The `where` clause cannot directly aggregate multivalue fields with `sum()`; it requires an explicit `eval` to compute the sum (e.g., `eval total=mvsum(amount)`) or a `stats` command. Without this, the `where` clause evaluates `sum(amount)` as a string operation or fails silently, returning no results.

Answer

The `amount<50` filter is applied before the transaction, which excludes amounts exactly $50.

Answer

The search lacks a `fields` command to include `user_id`, so the transaction fails.

Answer

The `maxspan=1h` is too short; users might spread transactions over more than 1 hour.

Question 19

Which TWO statements correctly describe the behavior of the transaction command in Splunk?

Accepted Answer

It can concatenate the raw text of all events in the transaction into a single event.. Option C is correct because the transaction command groups related events and, by default, produces a single merged event whose raw text (_raw) concatenates the raw text of all events in the transaction (delimited by newlines), which is exactly what it describes. Option E is correct because transaction supports closing conditions via parameters such as maxspan, maxpause, and startswith/endswith, and it can also use the 'close' behavior triggered by a field value change or a specified timeout (e.g., maxpause/maxspan), so transactions can be bounded by field changes or time limits. Option A is not marked correct: while transaction is memory- and performance-intensive and generally discouraged for very large datasets, the statement as phrased is a recommendation rather than a precise description of command behavior, and the exam's correct answers here are C and E. Option B is incorrect because transaction does not simply merge all fields with the last event's value taking precedence; it groups events and can preserve multivalue fields, and field merging behavior is not defined as 'last value wins' for all fields. Option D is incorrect because transaction does not automatically calculate a duration field for each transaction; duration is computed only if you explicitly calculate it (e.g., using eval with the transaction's first and last timestamps), not as an automatic behavior.

Answer

It is not recommended for use with large datasets because it consumes too much memory.

Answer

It merges all fields from all events into a single event, with the last event's field value taking precedence.

Answer

It automatically calculates the duration of each transaction as the difference between the first and last event timestamps.

Question 20

A team is using the transaction command to group web server access logs into user sessions. They notice some sessions are missing because the transaction command defaults to combining events with identical field values if they occur within a default time window. What is the default maxspan value for the transaction command?

Accepted Answer

-1 (no default limit). The default maxspan is -1 (unlimited). Options A, C, and D are common misconceptions but incorrect.

Answer

1 minute

Answer

30 seconds

Answer

5 minutes