SPLK-1002 Transactions and Event Correlation Practice Question
A search uses `transaction` with wildcard fields (e.g., `*id`), causing poor performance. What is the best practice to optimize this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Specify exact field names instead of wildcards
Using specific field names instead of wildcards reduces the overhead of matching multiple fields, improving transaction performance. Option B is invalid syntax; `nullif` is not a transaction option here. Option C increases limits but does not address the root cause of wildcard inefficiency. Option D changes the approach to `stats`, which may not preserve transaction boundaries.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Specify exact field names instead of wildcards
Why this is correct
Transaction matches fields exactly; wildcards slow down because Splunk must evaluate multiple fields.
- ✗
Use `transaction *id, nullif=null`
Why it's wrong here
Not a valid improvement; nullif is for null handling.
- ✗
Increase maxopentxn in limits.conf
Why it's wrong here
Increasing limits doesn't fix wildcard inefficiency.
- ✗
Replace transaction with stats
Why it's wrong here
stats is an alternative, but the best practice for transaction is to specify exact fields.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1002 question from scratch — 475 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SPLK-1002
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A transaction search is processing too many fields. Which command should be used immediately before the transaction command to reduce memory usage?
easy- A.fields - _raw, _time
- B.fields + user_id, _time
- C.fields - * except user_id
- ✓ D.fields user_id, _time
Why D: The 'fields' command with a positive list (without '+' or '-') sets the field list to exactly those specified, keeping only user_id and _time. This reduces memory usage significantly before the transaction command, which typically needs _time and a grouping field like user_id. Option A is incorrect because removing _raw and _time but keeping other fields does not sufficiently reduce fields; transaction requires _time. Option B is incorrect because 'fields +' adds fields to the existing set, not replacing them, so it does not reduce memory. Option C is incorrect because 'fields - * except user_id' removes all fields except user_id, but also removes _time, which is essential for the transaction command to correlate events based on time.
Variation 2. Which TWO of the following are limitations of the transaction command in Splunk?
easy- A.It cannot be used inside an eval statement.
- B.It only works with indexed fields.
- ✓ C.It defaults to a maximum of 1000 events per transaction.
- D.It cannot correlate events from multiple sourcetypes.
- ✓ E.It can consume significant memory and processing resources.
Why C: The transaction command defaults to a maximum of 1000 events per transaction. If a transaction exceeds this limit, Splunk will close the transaction and start a new one, which can lead to incomplete or unexpected results. This limit can be increased using the maxevents argument, but it is a key constraint to be aware of when correlating large sequences of events.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.