SPLK-1002 Transactions and Event Correlation Practice Question
A large e-commerce site logs all user page views and purchases. Each event contains user_id, session_id, timestamp, and event_type (view or purchase). The marketing team wants to analyze the sequence of views that lead to a purchase. They use `transaction session_id startswith="view" endswith="purchase" maxspan=1h`. However, they find that some transactions are missing purchase events because the purchase occurs after 1 hour, or sometimes multiple purchases occur within the same session. To include all related events and correctly identify the sequence leading to each purchase, what is the best approach?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use `stats list(event_type) by session_id` with time sorting to reconstruct the sequence.
Using `stats list(event_type) by session_id` with a sort on timestamp preserves the order of events and handles multiple purchases and variable time spans without the limitations of the transaction command. Option B (keepevicted=true) still requires a start and end for each purchase, missing scenarios where purchase occurs after the window. Option C (increase maxspan to 24h) would still break on multiple purchases and increase memory usage. Option D (group by user_id) loses session distinction and may merge separate sessions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use `stats list(event_type) by session_id` with time sorting to reconstruct the sequence.
Why this is correct
Correct: stats list maintains event order per session and naturally handles multiple purchases and any time span.
- ✗
Use `transaction session_id startswith="view" endswith="purchase" maxspan=1h keepevicted=true` to see partial sequences.
Why it's wrong here
Incorrect: keepevicted=true still requires both view and purchase boundaries; it doesn’t capture sequences without a matching purchase within the maxspan.
- ✗
Increase maxspan to 24h to capture all potential purchases.
Why it's wrong here
Incorrect: Increasing maxspan does not handle multiple purchases per session and may cause memory issues.
- ✗
Use `transaction user_id maxspan=1h` without startswith/endswith to group all events.
Why it's wrong here
Incorrect: Grouping by user_id mixes distinct sessions and loses session-level correlation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1002 question from scratch — 475 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SPLK-1002
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A financial company wants to group all events related to a single trading session. The session ID appears in all events. Which is the most efficient way to correlate these events without using transaction?
medium- A.Use sort to order events by timestamp.
- ✓ B.Use stats with values() on the event fields.
- C.Use join to combine events on sessionId.
- D.Use append with a subsearch.
Why B: Using stats with values() can list all events per session ID efficiently. Option A (sort) reorders by timestamp but does not group events by session. Option C (join) is for lookup, not for grouping events. Option D (append with subsearch) merges results but doesn't group by session ID.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.