SPLK-1002 Transactions and Event Correlation Practice Question
A Splunk administrator notices that the 'transaction' command is consuming excessive memory when processing a large dataset. The dataset contains events with a common field 'user_id', and the goal is to group events per user within 1 hour. Which approach would best reduce memory usage while still achieving the desired correlation?
⚠ Common exam trap
Watch out — candidates often assume increasing maxspan or adding fields will reduce memory usage, but these actions actually increase the memory footprint or do not address the root cause of excessive data volume.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a subsearch to first filter events and then apply transaction on the smaller set.
Using a subsearch first reduces the dataset size before the 'transaction' command processes it, directly addressing the memory issue. The 'transaction' command groups events into memory until they are finalized, so a smaller input set means fewer events held simultaneously, lowering memory consumption while still allowing the 1-hour maxspan correlation per user_id.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the 'kvform' command instead of transaction.
Why it's wrong here
kvform extracts key-value pairs, not correlate events into groups.
- ✓
Use a subsearch to first filter events and then apply transaction on the smaller set.
Why this is correct
A subsearch can pre-filter or aggregate events, reducing the input size for transaction and thus memory.
- ✗
Add more fields to the transaction to make it more specific.
Why it's wrong here
Adding fields increases memory usage as more data is stored per transaction.
- ✗
Increase the maxspan value to 2 hours to reduce the number of transactions.
Why it's wrong here
Increasing maxspan actually may increase the number of events per transaction, worsening memory usage.
Go deeper
Related to this question
About these practice questions
This SPLK-1002 question is part of Courseiva's 475-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.