Question 403 of 475
SPLK-1002 Transactions and Event Correlation Practice Question
A security team wants to detect a multi-step attack pattern: a user logs in from a new IP address, then within 10 minutes performs a privilege escalation, and finally accesses a sensitive file. They have events with fields: user, ip, action, and timestamp. Which SPL transaction statement should they use to group these three events into one transaction, ensuring all three actions occur in order?
⚠ Common exam trap
Splunk often tests the misconception that `transaction` requires all specified fields to match exactly, leading candidates to include `action` in the transaction fields, which would incorrectly split the three different actions into separate transactions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
`transaction user maxspan=10m`
`transaction user maxspan=10m` groups all events from the same user that occur within a 10-minute window. The events are inherently ordered by timestamp, so the three actions (login, privilege escalation, sensitive file access) will appear in chronological order within the transaction, satisfying the requirement. Including `action` or `ip` in the transaction fields would split the three different actions or IP addresses into separate transactions, preventing detection of the complete pattern.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
`transaction user,ip,action maxspan=10m`
Why it's wrong here
Using multiple fields for grouping would create separate transactions for each unique combination, which is not intended.
- ✓
`transaction user maxspan=10m`
Why this is correct
Groups by user within a 10-minute window, allowing the sequence to be verified later.
- ✗
`transaction user maxpause=30s`
Why it's wrong here
Maxpause would break the transaction if events are more than 30 seconds apart, which is too restrictive for a 10-minute pattern.
- ✗
`transaction user mvcount=3`
Why it's wrong here
mvcount is not a valid transaction parameter.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 30, 2026
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.