SPLK-1002 Transactions and Event Correlation Practice Question
A search uses `transaction session_id maxspan=30m` to group events. The search returns 5000 transaction events. The analyst needs to filter out any transaction that does not contain an event with status=failure. Which post-transaction command should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
`| transaction session_id maxspan=30m | search status=failure`
After transaction, you can use `where` with a subsearch or use `search` to filter based on fields within the transaction. Specifically, `search` can be used after transaction to filter events that contain a certain field-value pair.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
`| transaction session_id maxspan=30m | stats count(eval(status="failure")) by session_id`
Why it's wrong here
This would aggregate again, not filter.
- ✓
`| transaction session_id maxspan=30m | search status=failure`
Why this is correct
Yes, because after transaction, the resulting events have fields from all constituent events; if any constituent had status=failure, the transaction event will have that field. The search filters for transactions that contain at least one such event.
- ✗
`| transaction session_id maxspan=30m | where status=failure`
Why it's wrong here
`| where status=failure` applied post-transaction filters the *resulting transaction events*, not their constituent individual events. It would only return transactions where the aggregated `status` field on the transaction itself is `failure`, failing to identify transactions containing *any* event with `status=failure`. This command is useful for filtering transactions based on their own aggregated fields, like `duration` or `eventcount`, or other fields present on the transaction record itself.
- ✗
`| transaction session_id maxspan=30m | eval has_failure=if(match(_raw, "failure"),1,0) | where has_failure=1`
Why it's wrong here
The `eval has_failure=if(match(_raw, "failure"),1,0)` command operates on the aggregated `_raw` field of the entire transaction event, not the individual constituent events. Consequently, it cannot reliably identify if any specific event *within* the transaction contained the field-value pair `status=failure`. It only checks for the literal string "failure" in the concatenated raw text, which is insufficient for filtering based on a structured field. This approach is tempting as `eval` and `match` are standard for string pattern matching; it would be correct if the requirement was to filter transactions where the literal string "failure" appeared anywhere in the raw text of any constituent event.
Go deeper
Related to this question
About these practice questions
One of 475 original SPLK-1002 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.