SPLK-1002 transaction command Practice Question
A large e-commerce company uses Splunk to analyze customer purchase funnels. Their environment includes 10 indexers and a search head cluster. They have a search that runs every 5 minutes to correlate events from web logs, order logs, and payment logs using the `transaction` command on a common `order_id` field. The search uses `transaction order_id maxevents=50 maxspan=30m`. Recently, users have reported that some orders are missing from the results, especially for high-volume periods. The team also notices that dashboard searches often timeout. They suspect the transaction command is the bottleneck. Upon examining the search, they see that the web logs alone generate hundreds of events per order. Which course of action would best address the missing orders and performance issues?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Replace transaction with stats by order_id, using list() for relevant fields and evaluating event order separately
The `transaction` command is resource-intensive and can cause timeouts and missing data when `maxevents` is exceeded. Increasing `maxevents` (A) would worsen performance. Removing `maxpause` and increasing `maxspan` (B) does not address the `maxevents` limit and may keep transactions open longer. Reducing `maxevents` (C) would exacerbate missing orders. Replacing `transaction` with `stats ... list() by order_id` groups fields without holding open transactions, avoiding the `maxevents` constraint and reducing resource usage, thus addressing both missing orders and performance issues.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase maxevents to 200 and increase search timeout
Why it's wrong here
Increasing maxevents may help keep complete orders but will increase memory usage and may still not capture all events; increasing timeout doesn't fix missing orders.
- ✗
Remove maxpause and set maxspan to 60m
Why it's wrong here
This may keep transactions open longer but doesn't address event count limits; missing orders due to maxevents would persist.
- ✗
Reduce maxevents to 10 to limit resource usage
Why it's wrong here
Reducing maxevents will evict even more orders, worsening missing data.
- ✓
Replace transaction with stats by order_id, using list() for relevant fields and evaluating event order separately
Why this is correct
Using stats is more memory-efficient and does not have maxevents limits; it can aggregate all events per order without eviction, and performance improves because it avoids the overhead of tracking open transactions.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1002 question from scratch — 475 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.