SPLK-1002 Transactions and Event Correlation Practice Question
A large e-commerce company uses Splunk to monitor its web application performance. The application logs every HTTP request with fields: `transaction_id`, `url`, `response_time_ms`, `status`. Currently, the team uses the following search to identify slow page loads:
`index=web sourcetype=access_combined | transaction transaction_id maxspan=60s | eval total_time = sum(response_time_ms) | where total_time > 5000`
However, the search returns no results even though there are known slow pages. The team verified that logs contain `transaction_id` values and that some pages take over 10 seconds. What is the most likely reason the search fails to identify slow pages?
⚠ Common exam trap
Watch out — candidates often assume `sum()` in `eval` automatically aggregates multivalue fields, but Splunk's `eval` does not support aggregation functions on multivalue fields without explicit `mv` functions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The `eval total_time = sum(response_time_ms)` is incorrect because after `transaction`, `response_time_ms` is a multivalue field, and `sum()` does not automatically calculate the sum of multivalue fields.
After the `transaction` command, `response_time_ms` becomes a multivalue field containing all the individual response times from the events in the transaction. The `sum()` function in `eval` does not automatically aggregate multivalue fields; it requires explicit use of the `mvsum()` function or a `stats sum()` approach. Without this, `total_time` is not calculated correctly, so the `where` clause never matches, returning no results despite slow pages existing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The `maxspan=60s` is too short; some page loads may take longer than 60 seconds, causing incomplete transactions.
Why it's wrong here
Even if some take longer, known 10-second loads should be captured.
- ✗
The `transaction` command is grouping by `transaction_id`, but the events might have different transaction_id values for the same page load.
Why it's wrong here
If transaction_id is correctly logged, this should work.
- ✗
The field name is misspelled; it should be `response_time` not `response_time_ms`.
Why it's wrong here
No evidence of misspelling.
- ✓
The `eval total_time = sum(response_time_ms)` is incorrect because after `transaction`, `response_time_ms` is a multivalue field, and `sum()` does not automatically calculate the sum of multivalue fields.
Why this is correct
`sum()` is a statistical function; you need `eval total_time = mvsum(response_time_ms)` or use `stats sum` in a different approach.
Go deeper
Related to this question
About these practice questions
One of 475 original SPLK-1002 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.