SPLK-1002 maxtime Practice Question
A Splunk search uses 'transaction' to correlate events. The transaction times out before all expected events are added. Which TWO options can be adjusted to allow more time for transaction completion? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Increase 'maxevents'.
Options C and E are correct. 'maxevents' sets the maximum number of events per transaction; increasing it allows more events to be collected before the transaction times out. 'maxtime' sets the maximum time (in seconds) from the first event to the transaction completion; increasing it gives the transaction more time to complete. Option A ('maxopentxn') controls the maximum number of concurrent open transactions, not the timeout. Option B ('connected=false') changes event grouping behavior and does not extend time. Option D ('maxspan') defines the maximum time span between earliest and latest event in a transaction; decreasing it would shorten the window and likely cause more timeouts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase 'maxopentxn'.
Why it's wrong here
Incorrect: Affects parallel transactions, not timeout.
- ✗
Set 'connected=false'.
Why it's wrong here
Incorrect: Changes grouping behavior, not timeout.
- ✓
Increase 'maxevents'.
Why this is correct
Correct: Allows more events per transaction.
- ✗
Decrease 'maxspan'.
Why it's wrong here
Incorrect: Reduces time window, may cause earlier timeout.
- ✓
Increase 'maxtime' in the transaction command.
Why this is correct
Correct: Allows more processing time.
Go deeper
Related to this question
About these practice questions
One of 475 original SPLK-1002 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.