SPLK-1002 Transactions and Event Correlation Practice Question
A financial services company uses Splunk to monitor transactions between internal systems. Each transaction consists of a request event and a response event with identical fields: transaction_id, timestamp, component, status. The request event has component='app' and status='request'; the response event has component='db' and status='success' or 'failure'. The analyst runs the following search to correlate them: `index=main (component=app OR component=db) | transaction transaction_id maxspan=30s`. However, they notice that the search takes too long and often times out when there are many transactions. What change would most effectively reduce search time while still correctly grouping request-response pairs?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use `transaction transaction_id maxevents=2 maxspan=30s`.
Adding `maxevents=2` limits each transaction to exactly two events (a request and a response), preventing large groupings that cause memory issues and timeouts. The `maxspan=30s` already sets a time window. Option A (using a time range picker) does not address the internal grouping inefficiency. Option B (`stats values(*) as * by transaction_id`) does not maintain event order and can mix fields, failing to properly correlate request-response pairs. Option C (renaming component to type) does not improve performance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use `transaction transaction_id maxspan=30s` with a time range picker to limit the search to a smaller time window.
Why it's wrong here
Incorrect: The time range picker affects the overall search window, not the transaction grouping; maxspan already handles the time window.
- ✗
Use `stats values(*) as * by transaction_id` and then filter.
Why it's wrong here
Incorrect: stats only aggregates fields without preserving event sequence or timestamp order needed for correlation.
- ✗
Use `rename component to type` and then use `transaction`.
Why it's wrong here
Incorrect: Renaming fields does not address the performance issue.
- ✓
Use `transaction transaction_id maxevents=2 maxspan=30s`.
Why this is correct
Correct: maxevents=2 ensures each transaction contains only the expected two events, reducing memory and processing.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1002 question from scratch — 475 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.