How to Define Transaction Start and End with startswith and endswith
A security analyst needs to correlate login events with subsequent logout events for the same user session. Which command should be used to group these events together?
Quick Answer
The transaction command exists specifically for grouping related events into a single logical unit based on shared field values and, optionally, explicit content markers that define where a group begins and ends. Here, the shared field is the user or session identifier, and startswith='login' and endswith='logout' give the command an explicit rule for recognizing the first and last event in that session: any event matching the login condition opens a new transaction, and the corresponding logout event for that same session closes it, with everything in between automatically included as part of the same transaction. This is a more direct fit for the scenario than relying purely on time-based boundaries, because the session's actual start and end are defined by specific event content, login and logout, rather than by an assumed time window, which may not accurately reflect how long a real session lasts. Using startswith/endswith lets the command follow the natural, content-defined boundaries of the data instead of guessing them from timing alone. The general pattern worth remembering is that whenever a scenario describes correlating events with clear starting and ending markers, like login/logout, request/response, or open/close, startswith and endswith are the transaction options built exactly for that, rather than relying solely on time-window options to approximate the boundary.
⚠ Common exam trap
Splunk often tests the misconception that `stats` or `eval` can replace `transaction` for sessionization, but the trap is that `transaction` is the only command that natively groups events based on a start and end condition without requiring manual time-window calculations or complex field manipulation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the transaction command with startswith='login' and endswith='logout'.
The `transaction` command is specifically designed to group related events that share a common field (e.g., user or session ID) and occur within a defined time window. By using `startswith='login'` and `endswith='logout'`, it correctly identifies the beginning and end of a user session, grouping all intermediate events into a single transaction. This is the most direct and efficient method for correlating login and logout events in Splunk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use the transaction command with startswith='login' and endswith='logout'.
Why this is correct
transaction is designed exactly for this purpose: it groups events that share common fields and satisfy start/end conditions.
- ✗
Use the sort command by user and time to manually identify sessions.
Why it's wrong here
sort only reorders events; it does not group them into transactions.
- ✗
Use the stats command with values() and earliest().
Why it's wrong here
stats aggregates field values over a group, but does not create event groupings or handle boundaries like startswith/endswith.
- ✗
Use the eval command to create a session ID based on time differences.
Why it's wrong here
eval can compute fields but cannot group events; it would need to be combined with other commands like streamstats.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1002 question from scratch — 475 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SPLK-1002
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An analyst wants to group events that start with a 'login' event and end with a 'logout' event, using the username field. Which transaction syntax is correct?
easy- A.transaction username startswith=login endswith=logout
- B.transaction username startswith="login" endswith="logout" maxspan=2h
- C.transaction startswith="login" endswith="logout" by username
- ✓ D.transaction username startswith="login" endswith="logout"
Why D: The proper syntax for grouping events that start with 'login' and end with 'logout' using the username field is 'transaction username startswith="login" endswith="logout"'. Option A lacks quotes around the values, which would cause incorrect parsing. Option B includes an unnecessary 'maxspan=2h' which is not required by the question. Option C uses 'by username' incorrectly; the field should be placed immediately after 'transaction', not using the 'by' keyword.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.