The correct answer is `index=main (sourcetype=auth OR sourcetype=app) | transaction session_id maxspan=1h` because the `transaction` command groups events sharing a common field—here, `session_id`—into a single multievent transaction, and the `maxspan=1h` parameter enforces a one-hour time boundary between the first and last event in the group. This syntax is valid because `transaction` does not require a `sourcetype` argument; it correlates events across any sourcetypes as long as they share the specified field. On the SPLK-1003 exam, this question tests your understanding that `transaction` is used for sessionization across disparate data sources, and a common trap is confusing it with `stats` or `eventstats`, which require explicit aggregation functions. A key memory tip: think of `transaction` as a "field-based glue" that sticks events together by a common ID, while `maxspan` sets the maximum time window for that glue to hold.
SPLK-1003 Transactions and Event Correlation Practice Question
This SPLK-1003 practice question tests your understanding of transactions and event correlation. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An analyst wants to correlate events from two different sourcetypes: `auth` logs (login events) and `app` logs (application actions). Both logs share a common `session_id` field. The analyst needs to group all events from the same session, regardless of sourcetype, with a maximum time span of 1 hour. Which search correctly uses the `transaction` command?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
index=main (sourcetype=auth OR sourcetype=app) | transaction session_id maxspan=1h
Option C is correct because the `transaction` command groups events that share a common `session_id` field, and the `maxspan=1h` parameter restricts the transaction to a maximum time span of 1 hour. The syntax `transaction session_id maxspan=1h` is valid and ensures all events from both sourcetypes (`auth` and `app`) are correlated into sessions based on the shared field, regardless of sourcetype.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
index=main (sourcetype=auth OR sourcetype=app) | transaction by session_id maxspan=1h
Why it's wrong here
`transaction` uses fields directly, not a `by` clause; this syntax is invalid.
✗
index=main (sourcetype=auth OR sourcetype=app) | stats values(*) by session_id, _time
Why it's wrong here
`stats` does not create transaction groupings; it aggregates values.
✓
index=main (sourcetype=auth OR sourcetype=app) | transaction session_id maxspan=1h
Why this is correct
Correctly groups events by session_id with a 1-hour maxspan.
Related concept
Read the scenario before looking for a memorised answer.
`append` is unnecessary and performance-inefficient; a single search with OR is better.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Splunk often tests the subtle syntax difference between `transaction` and `transaction by` — candidates mistakenly add `by` as if it were a `stats` command, but `transaction` takes fields directly without a `by` clause.
Detailed technical explanation
How to think about this question
The `transaction` command in Splunk groups events based on one or more shared fields (like `session_id`) and can enforce constraints such as `maxspan` (maximum time between first and last event) and `maxpause` (maximum time between consecutive events). Under the hood, Splunk evaluates events in chronological order, opening a transaction when it encounters a new `session_id` value and closing it when the `maxspan` or `maxpause` threshold is exceeded or when a new event with the same field arrives. In real-world scenarios, this is critical for sessionization in web applications where login events (auth logs) and subsequent user actions (app logs) must be correlated to analyze user behavior or detect anomalies.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the SPLK-1003 exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Transactions and Event Correlation — This question tests Transactions and Event Correlation — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: index=main (sourcetype=auth OR sourcetype=app) | transaction session_id maxspan=1h — Option C is correct because the `transaction` command groups events that share a common `session_id` field, and the `maxspan=1h` parameter restricts the transaction to a maximum time span of 1 hour. The syntax `transaction session_id maxspan=1h` is valid and ensures all events from both sourcetypes (`auth` and `app`) are correlated into sessions based on the shared field, regardless of sourcetype.
What should I do if I get this SPLK-1003 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An analyst needs to correlate events from a web server log and an application log to identify failed login attempts followed within 5 seconds by an error event. The events share a common session ID field. Which approach should the analyst use?
medium
✓ A.Use `transaction sessionID maxspan=5s` to group events by session ID within 5 seconds
B.Use `append` to combine the two sourcetypes and then `search` for the pattern
C.Use `eventstats` to compute counts by sessionID and then filter
D.Use `stats` with values() and a by clause on sessionID
Why A: The `transaction` command is designed to group related events based on shared field values (sessionID) within a specified time boundary (maxspan=5s). This allows the analyst to correlate web server and application log events that share the same session ID and occur within 5 seconds, making it straightforward to identify failed login attempts followed by an error event.
Variation 2. A security analyst is investigating a series of failed login attempts followed by successful logins from the same IP addresses within short time windows. They want to correlate these events into sessions representing potential brute-force attacks. Which TWO statements accurately describe best practices for using the transaction command in this scenario?
medium
A.Transaction command is optimized for correlating events over very long time ranges (over 24 hours).
✓ B.Transaction command requires at least one field to group events into sessions.
✓ C.Transaction command can define transaction boundaries using startswith and endswith conditions.
D.Transaction command can only be used with events that have identical timestamps.
E.Transaction command automatically deduplicates events within a transaction.
Why B: Option A is correct because transaction requires at least one field (like src_ip) to group events into sessions. Option D is correct because startswith and endswith allow defining the boundaries of a transaction, for example, using startswith for failed login and endswith for successful login. Option B is incorrect because transaction events do not need identical timestamps; they can span over time. Option C is incorrect because transaction does not automatically deduplicate events; dedup command would be needed. Option E is incorrect because transaction is not optimized for very long time ranges and can be resource-intensive.
Variation 3. An analyst wants to correlate events from different sourcetypes (e.g., authentication logs and VPN logs) that share a common user field. The goal is to create a single event per user session containing all fields from both sourcetypes. Which command is best suited for this?
easy
A.append
B.union
✓ C.transaction
D.join
Why C: Option D is correct. The transaction command groups events based on a common field (user) and can include events from multiple sourcetypes. Options A (append) adds rows, B (join) requires a field and may not preserve sessions, C (union) combines schemas but does not correlate.
Variation 4. A security analyst wants to group all authentication events (e.g., login, logout, failure) that occur within a 10-minute window for each user. The events are from multiple sources and share a common 'user' field. Which transaction command is most appropriate?
easy
A.... | transaction user maxspan=600 maxevents=100
B.... | transaction user maxpause=120
C.... | transaction user maxspan=600 startswith="login" endswith="logout"
✓ D.... | transaction user maxspan=600
Why D: Option A is correct because maxspan=600 seconds (10 minutes) bounds the transaction time window. Option B is incorrect because maxevents=100 may truncate transactions with more events. Option C is incorrect because startswith and endswith are not required and may exclude valid transactions. Option D is incorrect because using only maxpause could allow transactions to exceed 10 minutes if events continue.
Variation 5. An analyst wants to ensure that a transaction is only considered complete when it contains a specific end event. Which transaction parameter should be used?
easy
A.startswith
✓ B.endswith
C.maxpause
D.maxspan
Why B: Option D is correct because endswith defines the event that closes a transaction. Option A (startswith) defines the start event. Option B (maxspan) bounds total time. Option C (maxpause) bounds idle time.
Last reviewed: Jun 30, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SPLK-1003 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1003 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.