SPLK-1002 Transactions and Event Correlation Practice Question
A security analyst is investigating a series of failed login attempts followed by successful logins from the same IP addresses within short time windows. They want to correlate these events into sessions representing potential brute-force attacks. Which TWO statements accurately describe best practices for using the transaction command in this scenario?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Transaction command requires at least one field to group events into sessions.
The transaction command requires at least one field (like src_ip) to group events into sessions; without a grouping field, events cannot be correlated. Option C is correct because the transaction command can define transaction boundaries using startswith and endswith conditions, enabling detection of a sequence like failed login followed by successful login. Option A is incorrect because transaction is not optimized for very long time ranges; it can be resource-intensive and is better suited for shorter windows. Option D is incorrect because transaction does not require identical timestamps; events can span time. Option E is incorrect because transaction does not automatically deduplicate events; you would need the dedup command for that.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Transaction command is optimized for correlating events over very long time ranges (over 24 hours).
Why it's wrong here
Incorrect: Transaction is memory-intensive and not suitable for very long time spans.
- ✓
Transaction command requires at least one field to group events into sessions.
Why this is correct
Correct: A field like src_ip is needed to group related events.
- ✓
Transaction command can define transaction boundaries using startswith and endswith conditions.
Why this is correct
Correct: startswith and endswith are valid options to mark transaction boundaries.
- ✗
Transaction command can only be used with events that have identical timestamps.
Why it's wrong here
Incorrect: Transactions can span over time, so events can have different timestamps.
- ✗
Transaction command automatically deduplicates events within a transaction.
Why it's wrong here
Incorrect: Transaction does not deduplicate; use dedup separately.
Go deeper
Related to this question
About these practice questions
This SPLK-1002 question is part of Courseiva's 475-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.