Transactions and Event Correlation →hardMultiple ChoiceObjective-mapped

SPLK-1002 Transactions and Event Correlation Practice Question

Exhibit

Refer to the exhibit.

| transaction user maxspan=30m maxevents=5 startswith="login" endswith="logout"
| eval duration=tostring(_time_delta,"duration")
| stats count by user duration

A Splunk analyst runs the above search. The results show that some transactions have a duration of 0 seconds. What is the most likely cause?

⚠ Common exam trap

Splunk often tests the misconception that a 0-second duration is caused by a grouping or ordering error, when in fact it is a direct result of incomplete transactions (missing end events) within the transaction command's logic.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Some user sessions are missing a logout event, resulting in a transaction that consists of only a login event, so _time_delta is undefined or zero.

When a transaction lacks an end event (like a logout), the transaction command closes based on other limits (e.g., maxspan, maxpause, or maxevents) and contains only the start event. In such cases, the duration (_time_delta) is calculated from the first event's timestamp to the last event's timestamp; with only one event, the difference is zero or undefined, resulting in a 0-second duration.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The transaction command failed to group events properly and returned only the login event.
Why it's wrong here
If it failed, no transaction would be created; but the analyst sees transactions with 0 duration, meaning they exist.
✗
The transaction command is processing events out of order, causing login and logout timestamps to be the same.
Why it's wrong here
Splunk processes events in chronological order by default; out-of-order processing would not cause zero duration.
✗
The maxevents=5 limitation causes the transaction to close early, but the logged duration is still calculated correctly from the first event timestamp.
Why it's wrong here
maxevents limits the number of events but does not cause zero duration; duration is based on first and last event timestamps.
✓
Some user sessions are missing a logout event, resulting in a transaction that consists of only a login event, so _time_delta is undefined or zero.
Why this is correct
Without a logout event, the transaction may contain only one event, and duration is not calculated, defaulting to 0.

Go deeper

SPLK-1002 Transactions and Event Correlation Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question