SPLK-1002 Transactions and Event Correlation Practice Question
A transaction is created using the command: 'index=web status=200 OR status=404 | transaction sessionid'. The user wants to include transactions only if they contain both a 200 and a 404 status. Which additional step achieves this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
| where mvcount(mvdedup(status))>=2
`| where mvcount(mvdedup(status))>=2`. After the initial `transaction` command, each event in a transaction has a multivalue field `status` containing the status codes from all events in that transaction. The goal is to include only transactions that have both a 200 and a 404 status. Using `mvdedup(status)` removes duplicate status values, then `mvcount()` counts the distinct values. If the count is >=2, it means both statuses are present. Option A uses `keepevicted=true` which is irrelevant; option C is just a search that doesn't filter by transaction; option D counts all occurrences (including duplicates), which could be 2 even if only one status appears twice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
| transaction sessionid keepevicted=true | where mvcount(status)>=2
Why it's wrong here
Incorrect: Keepevicted includes incomplete transactions; still counts duplicates.
- ✓
| where mvcount(mvdedup(status))>=2
Why this is correct
Correct: Counts distinct status values.
- ✗
| search status="200" OR status="404"
Why it's wrong here
Incorrect: OR includes transactions with only one of the statuses.
- ✗
| where mvcount(status)==2
Why it's wrong here
Incorrect: Counts total occurrences, may match two same status events.
Go deeper
Related to this question
About these practice questions
One of 475 original SPLK-1002 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.