SPLK-1002 Transactions and Event Correlation Practice Question
An administrator runs a transaction command that groups events by a customer ID but notices that some transactions are missing expected events. The log shows that the events are present and within the maxpause. What could be the reason?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Events are from different hosts or sources.
The transaction command, by default, groups events not only by the specified 'by' fields but also by host, source, and sourcetype. If events for the same customer ID originate from different hosts or sources, they are treated as separate transactions. This explains why some transactions are missing expected events despite the events being present and within the maxpause. Option A correctly identifies this common pitfall. Option B is incorrect because startswith and endswith define transaction boundaries and do not conflict here. Option C is incorrect because the 'fields' option is not required; without it, the default grouping includes host and source, which causes the issue. Option D is incorrect because the maxpause is explicitly stated to be adequate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Events are from different hosts or sources.
Why this is correct
By default, transaction groups by host, source, and sourcetype; events from different hosts are not grouped.
- ✗
The startswith and endswith are conflicting.
Why it's wrong here
Conflicting patterns would cause no transaction, not missing events.
- ✗
The fields option is missing.
Why it's wrong here
fields is optional and does not affect grouping.
- ✗
The maxpause value is too short.
Why it's wrong here
The log shows events are within maxpause, so that is not the issue.
Go deeper
Related to this question
About these practice questions
One of 475 original SPLK-1002 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.