SPLK-1002 Transactions and Event Correlation Practice Question
A Splunk administrator notices that a transaction command is consuming excessive memory and taking too long to complete. The transaction is defined on a field with high cardinality. Which of the following would most effectively reduce memory usage and improve performance?
⚠ Common exam trap
The trap here is that candidates often focus on adjusting time-based parameters (maxspan, maxpause) or output options (keepevicted) instead of recognizing that the fundamental issue is the cardinality of the grouping field, which directly drives memory and state management overhead.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a different field with lower cardinality for grouping
The transaction command groups events based on field values, and high cardinality fields create many unique groups, each requiring memory for state tracking. Using a lower-cardinality field reduces the number of concurrent groups, directly lowering memory consumption and processing time. This addresses the root cause rather than adjusting timeouts or eviction policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase the maxspan value
Why it's wrong here
Increasing maxspan includes more events per transaction, increasing memory usage.
- ✗
Remove the maxspan constraint
Why it's wrong here
Removing maxspan could cause transactions to stay open longer, increasing memory.
- ✗
Set keepevicted=false
Why it's wrong here
While this helps, the primary issue is high cardinality; keepevicted=false may not be enough.
- ✓
Use a different field with lower cardinality for grouping
Why this is correct
Lower cardinality means fewer transaction groups, reducing memory and computation.
Go deeper
Related to this question
About these practice questions
This SPLK-1002 question is part of Courseiva's 475-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.