Filtering Transactions by Event Count — Using mvcount and maxevents
A security analyst is writing a search to detect lateral movement across servers by correlating authentication events from multiple domain controllers. Each event has a `user`, `src_ip`, and `dest_ip`. The analyst wants to group events where the same user authenticates from at least 3 different source IPs within 10 minutes. Which TWO components must be part of the search to achieve this? (Choose TWO.)
Quick Answer
This question is really testing whether you understand what the transaction command's grouping options actually measure. transaction user groups events that share the same user value, and maxspan=10m constrains that grouping to a 10-minute window, together giving you exactly the same-user, tight-time-window correlation the scenario calls for. The trap is in how you'd try to enforce the at-least-3-different-source-IPs requirement: mvcount(src_ip) counts every value in the multivalue field the transaction produces, including duplicates, so a user who authenticates five times from the same two IPs would still pass a mvcount>=3 check even though only two distinct IPs are actually involved. That's a meaningful difference from what the scenario is actually asking for, which is distinct source IPs, not total authentication events. Getting from a raw multivalue count to a true distinct count requires deduplicating the values first, which mvcount alone does not do. The broader lesson is to read multivalue-field functions carefully on these exams: count-style functions like mvcount tell you how many values exist in a field, not how many unique values exist, and any scenario emphasizing distinct or different values is signaling that you need a deduplication step before you count.
⚠ Common exam trap
Watch out — candidates often confuse `maxevents` with the requirement for distinct source IPs, or think that `dedup` is needed to reduce data volume, when in fact it would break the correlation by removing necessary events.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use `transaction user` to group events by user.
Options A and C are correct. The `transaction user` command groups events by user, and `maxspan=10m` limits the grouping window. Option B is incorrect because `mvcount(src_ip)>=3` counts all occurrences of `src_ip`, not distinct IPs, so it does not guarantee that the user authenticated from at least 3 different source IPs. The correct approach would involve using a different method to ensure distinct IPs, such as removing duplicates within the transaction before counting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use `transaction user` to group events by user.
Why this is correct
Groups events by user for correlation.
- ✗
After the transaction, use `where mvcount(src_ip)>=3` to filter transactions with at least 3 distinct source IPs.
Why it's wrong here
This condition counts all occurrences of src_ip, not distinct IPs. Since the requirement is for at least 3 different source IPs, this condition does not guarantee distinctness and is therefore incorrect.
- ✓
Set `maxspan=10m` to limit the grouping window to 10 minutes.
Why this is correct
Ensures events are within 10 minutes.
- ✗
Use `maxevents=3` to ensure at least three events per transaction.
Why it's wrong here
Using `maxevents=3` ensures each transaction has at most 3 events, but does not ensure distinct source IPs. It could include multiple events from the same IP, so it does not satisfy the requirement.
- ✗
Use `dedup user` before the transaction to reduce events.
Why it's wrong here
Using `dedup user` before the transaction would remove duplicate events for the same user, potentially discarding events needed for the correlation, and does not help with distinct IPs.
Go deeper
Related to this question
About these practice questions
This SPLK-1002 question is part of Courseiva's 475-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SPLK-1002
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security team needs to correlate failed login attempts across multiple web servers to identify brute force attacks. Each server logs authentication failures with timestamps and source IPs. The team wants to create a transaction that groups failed attempts within 5 minutes from the same IP, but only if there are at least 3 failures. Which approach correctly implements this requirement?
medium- A.index=web sourcetype=access_combined status=401 | search clientip=* | head 3
- B.index=web sourcetype=access_combined status=401 | transaction clientip maxspan=5m maxevents=3
- C.index=web sourcetype=access_combined status=401 | stats count by clientip, _time
- ✓ D.index=web sourcetype=access_combined status=401 | transaction clientip maxspan=5m
Why D: Uses the `transaction` command with `maxspan=5m` to group events by `clientip` within a 5-minute window, capturing all failed attempts. To enforce the requirement of at least 3 failures, you would add a filter like `where mvcount(_raw) >= 3` after the transaction. Among the given options, D is the closest because it creates the necessary time-based grouping without incorrectly capping the number of events per transaction (as Option B does with `maxevents=3`, which sets a maximum, not a minimum).
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.