SPLK-1002 Transactions and Event Correlation Practice Question
A Splunk administrator is troubleshooting a search that uses the `transaction` command. The search is taking too long to complete and returning incomplete results. Which TWO changes are most likely to improve performance and accuracy of transaction searches? (Choose TWO.)
⚠ Common exam trap
Splunk often tests the misconception that increasing limits (like `maxevents` or removing `maxspan`) will improve results, when in fact it exacerbates resource exhaustion and incomplete data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use `fields` before `transaction` to include only necessary fields.
Using the `fields` command before `transaction` reduces the amount of data Splunk must process by retaining only the fields necessary for correlation and output. This minimizes memory and CPU overhead, directly improving search performance and reducing the risk of incomplete results due to resource limits.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remove the `maxspan` parameter to allow transactions of any duration.
Why it's wrong here
Removing maxspan can cause very long transactions, increasing memory and time.
- ✗
Use `mvcombine` to combine multivalued fields before the transaction.
Why it's wrong here
mvcombine is not relevant to transaction performance.
- ✓
Use `fields` before `transaction` to include only necessary fields.
Why this is correct
Reduces data volume processed by transaction.
- ✗
Increase the `maxevents` value to allow more events per transaction.
Why it's wrong here
Increases memory usage and may worsen performance.
- ✓
Set an appropriate `maxspan` value based on the expected duration of correlated events.
Why this is correct
Limits the time window for grouping, improving performance and preventing runaway transactions.
Go deeper
Related to this question
About these practice questions
One of 475 original SPLK-1002 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.