SPLK-1002 Transactions and Event Correlation Practice Question
A financial services company uses Splunk to detect fraudulent transactions. Each transaction event has fields: `user_id`, `amount`, `merchant`, `timestamp`. The fraud detection team wants to identify users who make multiple small transactions (under $50) totaling over $200 within a 1-hour window, which may indicate testing stolen credit cards. They write the following search:
`index=transactions sourcetype=payment amount<50 | transaction user_id maxspan=1h | where sum(amount) > 200`
This search runs but returns no results, even though manual inspection shows users with such patterns. What is the primary reason the search fails?
⚠ Common exam trap
Watch out — candidates often assume `sum(amount)` works directly in a `where` clause after `transaction`, but Splunk requires explicit multivalue field aggregation functions like `mvsum()` to compute totals from grouped events.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The `where sum(amount) > 200` does not work as expected because `sum()` is not an aggregation function in that context; you need to use `stats sum(amount)` or `eval total=mvsum(amount)` first.
The `transaction` command creates a single multivalue field `amount` containing all amounts from the grouped events. The `where` clause cannot directly aggregate multivalue fields with `sum()`; it requires an explicit `eval` to compute the sum (e.g., `eval total=mvsum(amount)`) or a `stats` command. Without this, the `where` clause evaluates `sum(amount)` as a string operation or fails silently, returning no results.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The `amount<50` filter is applied before the transaction, which excludes amounts exactly $50.
Why it's wrong here
The filter is correct; amounts under $50 are included.
- ✗
The search lacks a `fields` command to include `user_id`, so the transaction fails.
Why it's wrong here
`user_id` is implicitly available.
- ✗
The `maxspan=1h` is too short; users might spread transactions over more than 1 hour.
Why it's wrong here
The pattern is within 1 hour, so it should capture.
- ✓
The `where sum(amount) > 200` does not work as expected because `sum()` is not an aggregation function in that context; you need to use `stats sum(amount)` or `eval total=mvsum(amount)` first.
Why this is correct
`sum()` in `where` does not aggregate multivalue fields; it returns the sum of the first value.
Go deeper
Related to this question
About these practice questions
One of 475 original SPLK-1002 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.