SPLK-1002 Transactions and Event Correlation Practice Question
A Splunk administrator is troubleshooting a slow search that uses the transaction command. The search correlates events by 'user_uuid' with a maxspan of 1 hour. The administrator suspects that many orphan events (events that never complete a transaction) are causing performance issues. Which approach can help identify and possibly exclude orphan events from the transaction?
⚠ Common exam trap
It's easy for candidates to confuse `keepevicted` with a way to keep orphan events in the output, when in fact it marks them with an `evicted` field so you can explicitly filter them out, and they may also incorrectly assume `closed_txn` is a valid parameter without knowing its exact syntax (`closed_txn=t`).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the 'keepevicted=true' option and then filter out evicted events in a subsequent search.
The `keepevicted=true` parameter causes the `transaction` command to output events that were evicted from the transaction window (orphans) with an `evicted` field set to 1. You can then filter out these evicted events in a subsequent search using `where evicted=0`, which isolates only complete transactions and removes the performance overhead of orphan events.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase maxspan to allow more events to complete.
Why it's wrong here
Increasing maxspan may include more events but does not specifically address orphans and could worsen performance.
- ✗
Use the 'mvlist' option to list all user_uuid values.
Why it's wrong here
mvlist is not a valid transaction option.
- ✓
Use the 'keepevicted=true' option and then filter out evicted events in a subsequent search.
Why this is correct
keepevicted=true preserves events that were not included in any transaction, allowing you to analyze or exclude them.
- ✗
Add 'closed_txn=1' to the transaction command to only output complete transactions.
Why it's wrong here
closed_txn is not a valid transaction option.
Go deeper
Related to this question
About these practice questions
This SPLK-1002 question is part of Courseiva's 475-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.