SPLK-1002 Transactions and Event Correlation Practice Question
A search includes 'transaction userid maxspan=1h maxopentxn=1000'. What is the purpose of maxopentxn?
⚠ Common exam trap
A common trap is confusing `maxopentxn` with `maxtxn`, which limits the total number of transactions in the output. `maxopentxn` is a memory management setting, not a result limiter.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It limits the number of transactions that can be open simultaneously in memory.
The `maxopentxn` parameter in the `transaction` command limits the number of transactions that can be open at the same time in memory. Once this limit is reached, the transaction with the longest idle time is closed forcefully. This prevents excessive memory usage when many transactions are in progress. It does not directly limit the total number of transactions in the final results, nor does it limit events per transaction or time span of open transactions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It limits the total number of transactions in the search results.
Why it's wrong here
Incorrect. `maxopentxn` does not limit the total number of transactions in the search results; `maxtxn` serves that purpose. This option describes `maxtxn` behavior.
- ✓
It limits the number of transactions that can be open simultaneously in memory.
Why this is correct
Correct. `maxopentxn` limits the number of transactions that can be open simultaneously in memory. When the limit is reached, the oldest idle transaction is closed to free memory.
- ✗
It limits the number of events per transaction.
Why it's wrong here
Incorrect. Events per transaction are limited by `maxevents` or other parameters, not by `maxopentxn`.
- ✗
It limits the time span of open transactions.
Why it's wrong here
Incorrect. The time span of open transactions is limited by `maxspan`, not `maxopentxn`.
Go deeper
Related to this question
About these practice questions
This SPLK-1002 question is part of Courseiva's 475-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.