Courseiva

CCNA Transactions and Event Correlation Questions

75 of 118 questions · Page 1/2 · Transactions and Event Correlation · Answers revealed

Practice these questionsDomain overviewAll questions
1
Multi-Selecthard

In a Splunk environment, an analyst is using the transaction command to group events from different sources. Which THREE factors are most important to consider when designing the transaction search for optimal performance? (Choose three.)

Select 3 answers
A.Use the 'mvlist' option to store multiple values.
B.Use a large maxevents value to ensure all events are captured.
C.Apply efficient search-time field extractions to avoid using the transaction command across unindexed fields.
D.Limit the time range of the search using maxspan.
E.Use fields with low cardinality for grouping.
AnswersC, D, E

Correct: Improves search performance.

Why this answer

Options C, D, and E are correct. Efficient search-time field extractions (C) reduce the overhead of the transaction command by avoiding unindexed field lookups. Limiting the time range with maxspan (D) narrows the search window, reducing the number of events to process.

Using fields with low cardinality for grouping (E) minimizes the number of open transactions and memory usage. Option A (mvlist) is not a standard transaction option and does not improve performance; Option B (large maxevents) can degrade performance by consuming excessive memory.

Practice this question →
2
MCQeasy

An analyst wants to ensure that a transaction is only considered complete when it contains a specific end event. Which transaction parameter should be used?

A.startswith
B.endswith
C.maxpause
D.maxspan
AnswerB

Correct: endswith specifies the closing event.

Why this answer

The endswith parameter specifies the event that marks the end of a transaction. Option A (startswith) defines the start event. Option C (maxpause) sets the maximum idle time between events.

Option D (maxspan) sets the maximum total duration of the transaction.

Practice this question →
3
MCQmedium

A Splunk administrator is tuning a dashboard that uses `transaction` to correlate web server events. The dashboard frequently times out. The admin reviews the search and sees `transaction client_ip maxspan=1h maxpause=30m`. The dataset contains about 10 million events per hour. The admin suspects that the transaction is causing the timeout. Which action should they take to improve performance while still achieving the grouping?

A.Replace transaction with streamstats to create a session ID, then use stats to aggregate
B.Add `maxevents=100` to limit events per transaction
C.Reduce maxspan to 15m and maxpause to 5m
D.Increase the search job concurrency
AnswerA

streamstats can process events sequentially and assign IDs, then stats can group without the full overhead of transaction.

Why this answer

The transaction command is memory-intensive, especially with a large dataset (10 million events per hour) and generous limits (maxspan=1h, maxpause=30m). To improve performance, a more efficient approach is to use streamstats to generate a session ID based on a timeout (e.g., using the time difference between events) and then use stats to group by that ID. This avoids holding all events in memory and processes events in a streaming manner.

Option A correctly suggests this method. Option B (maxevents=100) still uses transaction and may truncate valid sessions. Option C reduces limits but may miss legitimate sessions and still uses transaction.

Option D increases search job concurrency but does not address the underlying memory issue.

Practice this question →
4
Multi-Selecthard

Which THREE of the following are valid use cases for the `transaction` command in Splunk?

Select 3 answers
A.Identifying a sequence of events that indicate a brute-force attack (multiple failed logins followed by a success).
B.Generating an alert when a transaction contains more than five events.
C.Grouping all events from a single user session across multiple web servers into one transaction.
D.Enriching events with external data from a CSV file based on a common key.
E.Correlating a customer's browsing activity with a subsequent purchase event to calculate conversion rate.
AnswersA, C, E

Transaction can group events by user and then you can search for the pattern.

Why this answer

The `transaction` command groups related events into a single transaction based on common fields and temporal constraints. In this case, it can group multiple failed login events followed by a successful login for the same user, which is a classic indicator of a brute-force attack. The command allows you to set `maxspan` and `maxpause` to define the time window and gap between events, making it ideal for detecting such sequences.

Exam trap

The trap here is that candidates confuse the `transaction` command with other commands like `stats` or `lookup`, or mistakenly think it can directly trigger alerts, when in fact it only creates transaction objects that can then be used in alerts or further processing.

Practice this question →
5
Multi-Selecteasy

Which TWO statements about the 'transaction' command are true? (Choose two.)

Select 2 answers
A.The 'transaction' command cannot be used with the 'stats' command.
B.The 'transaction' command only works on indexed fields.
C.The 'transaction' command can include events from multiple sourcetypes.
D.The 'transaction' command groups events based on common field values and time proximity.
E.The 'transaction' command requires all events to be from the same host.
AnswersC, D

Correct: Events from different sourcetypes can be grouped.

Why this answer

Options C and D are correct. The `transaction` command groups events based on common field values and time proximity, and it can include events from multiple sourcetypes. Option A is false because `transaction` can be used with `stats` (e.g., `... | transaction ... | stats count`).

Option B is false because `transaction` works on any field, not just indexed fields. Option E is false because `transaction` does not require events to be from the same host; it can group events across different hosts if they share common field values.

Practice this question →
6
MCQmedium

An analyst runs the following search to correlate login and logout events: `index=auth | transaction user startswith="LOGIN" endswith="LOGOUT"`. However, some transactions span over 24 hours. Which option should be added to limit each transaction to a maximum of 8 hours?

A.maxevents=10
B.duration=8h
C.maxpause=8h
D.maxspan=8h
AnswerD

maxspan restricts the transaction to an 8-hour window.

Why this answer

Maxspan=8h limits the total time window of the transaction to 8 hours. Option A (maxevents) limits the number of events, not time. Option B (duration) is not a valid transaction option.

Option C (maxpause) limits inactivity between events, not the total span.

Practice this question →
7
Multi-Selectmedium

Which TWO options are valid parameters of the `transaction` command?

Select 2 answers
A.timeformat
B.maxpause
C.sequential
D.keepevicted
E.fieldlist
AnswersB, D

maxpause defines maximum pause between events.

Why this answer

Correct options: B (maxpause) and D (keepevicted). Option A (timeformat) is for time parsing, not transaction. Option C (sequential) is not a valid parameter of the `transaction` command.

Option E (fieldlist) is not a parameter; fields are given as arguments.

Practice this question →
8
MCQhard

A financial services company uses Splunk to correlate events from multiple applications. Analysts often use `transaction user_id` to group events, but they notice that this command significantly increases search time and memory usage. After investigating, they find that certain 'user_id' values are extremely frequent (e.g., service accounts) causing huge transactions with thousands of events, which exhaust search memory. The team needs to continue grouping by user_id but must avoid performance issues. They also need to preserve the ability to compute statistics like transaction duration. Which approach best addresses both concerns?

A.Set `maxpause=1m` to break large transactions by gaps
B.Use `transaction user_id maxspan=5m maxevents=100`
C.Exclude service accounts using `where user_id!="svc*"` before transaction
D.Switch to `stats values(_raw) by user_id` to avoid transaction overhead
AnswerB

Limits both total time and event count, preventing memory overload.

Why this answer

The correct approach is to use `transaction user_id maxspan=5m maxevents=100`. This limits each transaction to a maximum of 100 events within a 5-minute window, preventing huge transactions from service accounts while still allowing grouping by user_id and computation of statistics like duration. Option B directly addresses both concerns without excluding data.

Pre-filtering (option C) removes data, which may lose needed events or skew results, and is less robust than bounding transaction size.

Practice this question →
9
MCQmedium

A Splunk administrator is troubleshooting a slow search that uses the transaction command. The search correlates events by 'user_uuid' with a maxspan of 1 hour. The administrator suspects that many orphan events (events that never complete a transaction) are causing performance issues. Which approach can help identify and possibly exclude orphan events from the transaction?

A.Increase maxspan to allow more events to complete.
B.Use the 'mvlist' option to list all user_uuid values.
C.Use the 'keepevicted=true' option and then filter out evicted events in a subsequent search.
D.Add 'closed_txn=1' to the transaction command to only output complete transactions.
AnswerC

keepevicted=true preserves events that were not included in any transaction, allowing you to analyze or exclude them.

Why this answer

The `keepevicted=true` parameter causes the `transaction` command to output events that were evicted from the transaction window (orphans) with an `evicted` field set to 1. You can then filter out these evicted events in a subsequent search using `where evicted=0`, which isolates only complete transactions and removes the performance overhead of orphan events.

Exam trap

The trap here is that candidates confuse `keepevicted` with a way to keep orphan events in the output, when in fact it marks them with an `evicted` field so you can explicitly filter them out, and they may also incorrectly assume `closed_txn` is a valid parameter without knowing its exact syntax (`closed_txn=t`).

How to eliminate wrong answers

Option A is wrong because increasing `maxspan` would actually allow more events to be considered for a transaction, potentially increasing the number of orphan events and worsening performance, not solving the issue. Option B is wrong because `mvlist` is not a valid option for the `transaction` command; it is used with `stats` or `eventstats` to list multivalue fields, and it does not help identify or exclude orphan events. Option D is wrong because `closed_txn=1` is not a valid parameter for the `transaction` command; the correct way to output only complete transactions is to use the `closed_txn=t` option, but even then, it does not help identify orphan events for exclusion—it simply suppresses incomplete transactions from output, which may hide the problem but not address the underlying performance impact.

Practice this question →
10
MCQhard

A Splunk search uses 'transaction' with a large dataset and causes a 'max transaction' error. What is the most likely cause and best practice to avoid it?

A.The transaction command is used on non-indexed fields; use indexed fields instead.
B.The number of open transactions exceeds the limit; use fields to reduce cardinality or increase maxopentxn.
C.The maxspan value is too low; increase maxspan.
D.The maxevents value is too low; increase maxevents.
AnswerB

Correct: This resolves the max transaction error.

Why this answer

The error indicates the number of open transactions exceeded the limit (maxopentxn). Reducing field cardinality or increasing maxopentxn helps. Options A, C, and D address other issues.

Practice this question →
11
MCQmedium

An analyst wants to correlate events from multiple sourcetypes that have different timestamps but share a common reference ID. The events are ingested with some delay. Which parameter is crucial to ensure the transaction captures all related events despite ingestion delay?

A.maxpause
B.maxevents
C.fields _indextime
D.maxspan
AnswerD

Correct: a large maxspan gives time for delayed events to arrive.

Why this answer

A large maxspan accommodates delays in event arrival. Option A (maxpause) would not capture events if there is a large gap. Option B (maxevents) does not affect time.

Option C (fields _indextime) is irrelevant.

Practice this question →
12
MCQmedium

A large transaction command is causing the search to run out of memory. Which approach best reduces memory usage while maintaining the transaction logic?

A.Increase the maxeventtokens setting.
B.Use the fields option to include only necessary fields.
C.Replace transaction with stats to aggregate.
D.Use timeline to store transactions.
AnswerB

Limiting fields reduces the data per event, lowering memory consumption.

Why this answer

Using the fields option with the transaction command limits the fields carried in each event, reducing memory usage. Option A (increasing maxeventtokens) would increase memory consumption. Option C (replacing with stats) changes the correlation approach and may not preserve transaction logic.

Option D (timeline) is not relevant to memory reduction.

Practice this question →
13
Multi-Selectmedium

Which THREE of the following are correct about the transaction command's default behavior?

Select 3 answers
A.Transaction groups events by host, source, and sourcetype by default.
B.Transaction does not require startswith or endswith to be specified.
C.Transaction can evict partial transactions if maxpause is exceeded.
D.Transaction requires all events to come from the same host.
E.Transaction always includes all evicted events in the results.
AnswersA, B, C

Default grouping fields are host, source, and sourcetype.

Why this answer

Options A, B, and C are correct. By default, the transaction command groups events by host, source, and sourcetype (A). It does not require startswith or endswith to be specified; you can use fields or other options (B).

Transactions can evict partial transactions if maxpause is exceeded, meaning if no new events arrive within the maxpause period, the transaction is considered complete and evicted (C). Option D is false because transaction does not require all events to come from the same host; by default it uses host, source, sourcetype but you can override with fields. Option E is false because evicted transactions are not included in the results unless you use the keepevicted=true option.

Practice this question →
14
MCQmedium

A search uses `transaction sessionId` to correlate events. However, the transaction command is consuming too much memory and the search fails. Which approach can reduce memory usage while still approximating the transaction grouping?

A.Add `maxevents=100` to the transaction
B.Use `dedup sessionId`
C.Use `stats values(_raw) by sessionId`
D.Increase the search job memory limit
AnswerC

stats is lighter and can group events by a common field without the overhead of transaction.

Why this answer

Using `stats values(_raw) by sessionId` aggregates raw events into a multivalue field, which is more memory-efficient than transaction because it does not try to compute duration or keep all event metadata.

Practice this question →
15
MCQmedium

A team is using the transaction command to group web server access logs into user sessions. They notice some sessions are missing because the transaction command defaults to combining events with identical field values if they occur within a default time window. What is the default maxspan value for the transaction command?

A.1 minute
B.-1 (no default limit)
C.30 seconds
D.5 minutes
AnswerB

Correct: The default maxspan is -1, meaning no time limit.

Why this answer

The default maxspan is -1 (unlimited). Options A, C, and D are common misconceptions but incorrect.

Practice this question →
16
Multi-Selectmedium

Which THREE strategies can help reduce memory usage when using the transaction command? (Select exactly 3 correct answers.)

Select 3 answers
A.Filter events before the transaction command.
B.Reduce maxspan and maxpause.
C.Use fields to limit fields before transaction.
D.Use keepevicted=true.
E.Increase maxopentxn.
AnswersA, B, C

Correct: reducing input events lowers memory usage.

Why this answer

Reducing maxspan and maxpause limits the time window, thus fewer open transactions. Filtering events early and using the fields command to limit fields reduce data volume. Increasing maxopentxn and keepevicted=true increase memory usage.

Practice this question →
17
MCQeasy

An analyst runs `transaction user_id` to correlate events from a web server. The resulting transaction events have a field 'duration' that shows the time between the first and last event. However, some transactions span over 30 minutes. What transaction option should be added to limit the maximum time between the first and last event?

A.maxspan=30m
B.maxpause=30m
C.maxevents=30
D.contime=30m
AnswerA

Correctly limits the transaction span to 30 minutes.

Why this answer

The maxspan option sets the maximum time span from the first event to the last event in a transaction.

Practice this question →
18
MCQmedium

Refer to the exhibit. A security analyst runs this search to group SSH login events into sessions based on a session_id that is extracted only from 'Accepted publickey' events. However, the resulting transactions contain only the 'Accepted publickey' event and none of the subsequent commands or logouts. What is the most likely cause?

A.The maxpause=5m is too short, causing the transaction to close before other events occur.
B.The session_id field is only populated for the 'Accepted publickey' event, so other events have a different or null session_id and do not join the transaction.
C.The transaction command requires that all events have a non-null session_id to be grouped.
D.The sourcetype filter is too restrictive.
AnswerB

Only the start event gets a session_id; other events have null, so they are not grouped.

Why this answer

The `transaction` command groups events by the `session_id` field. If `session_id` is only extracted from 'Accepted publickey' events (e.g., via a `rex` or `eval` command), subsequent commands and logout events will have a null or different `session_id`. Since `transaction` requires all events in the group to share the same `session_id` value, those other events cannot join the transaction, resulting in a transaction containing only the single 'Accepted publickey' event.

Exam trap

The trap here is that candidates often assume `maxpause` or timing is the culprit, but the real issue is that the `transaction` command requires all events in the group to share the same value for the specified field(s), and if the field is missing or null on other events, they cannot be correlated.

How to eliminate wrong answers

Option A is wrong because `maxpause=5m` defines the maximum time between events in the same transaction; if other events occur within 5 minutes, they would still be included if they shared the same `session_id`. The issue is not timing but field availability. Option C is wrong because the `transaction` command does not require all events to have a non-null `session_id`; it groups events by the specified field(s), and events with a null `session_id` simply will not match the non-null value of the 'Accepted publickey' event.

Option D is wrong because the sourcetype filter is not mentioned in the exhibit or question as being overly restrictive; the problem is specifically about the `session_id` field not being populated on other events, not about sourcetype filtering.

Practice this question →
19
MCQmedium

A network operations team monitors firewall logs using Splunk. They need to group events from the same TCP session, identified by 'src_ip', 'dst_ip', and 'src_port'. The logs contain events for 'session_start', 'data_transfer', and 'session_end' actions. They currently use `transaction src_ip dst_ip src_port startswith=action=session_start endswith=action=session_end`. However, many transactions are incomplete because some sessions do not have a 'session_end' event due to firewall timeouts. The team wants to include these incomplete sessions as well, but still group them around a start event. What should they modify?

A.Add `maxspan=30m` and keep endswith
B.Remove endswith and add maxspan=30m
C.Change startswith to `action=session_start OR action=session_end`
D.Use `transaction src_ip dst_ip src_port maxspan=30m` without startswith or endswith
AnswerB

Startswith defines start; maxspan closes the transaction automatically after 30 minutes if no end.

Why this answer

To include incomplete sessions without an 'session_end' event, remove the `endswith` clause and add a `maxspan` time limit. This ensures that transactions are automatically closed after the specified time (30 minutes) if no end event is encountered. The `startswith` clause remains to initiate transactions only on 'session_start' events.

Option B correctly implements this: `transaction src_ip dst_ip src_port startswith=action=session_start maxspan=30m`. This way, sessions that timeout are still captured as transactions.

Practice this question →
20
Multi-Selecteasy

Which THREE statements about the `transaction` command are true?

Select 3 answers
A.It can correlate events from different sourcetypes
B.The maxevents option limits the number of unique field values per transaction
C.It sorts events within each transaction by _time
D.It can correlate events across multiple indexes
E.Transaction always produces summary indexing output
AnswersA, C, D

Transaction groups events based on shared field values regardless of sourcetype.

Why this answer

Correct: A, C, D. A is true because the `transaction` command can correlate events from different sourcetypes into a single transaction. C is true because `transaction` sorts events within each transaction by `_time` to ensure chronological ordering.

D is true because `transaction` can correlate events across multiple indexes. B is false because the `maxevents` option limits the maximum number of events per transaction, not the number of unique field values. E is false because `transaction` does not produce summary indexing output by default; it outputs events with a calculated duration field.

Practice this question →
21
Matchingmedium

Match each Splunk component to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Indexes and stores incoming data

Distributes search requests and merges results

Sends data to indexers or other forwarders

Manages configuration of forwarders

Manages license usage across the deployment

Why these pairings

In a Splunk distributed environment, the Search Head handles search distribution and result merging, the Indexer indexes and stores data, the Universal Forwarder collects and forwards data, and the Deployment Server manages configuration deployment. Common mistakes include swapping the roles of Search Head and Indexer, or confusing the Deployment Server with a forwarder.

Practice this question →
22
MCQmedium

An analyst is using the transaction command to group events by a field that has high cardinality (millions of unique values). The search is taking too long and consuming too much memory. Which approach should be taken to improve performance?

A.Reduce the cardinality of the field by using a derived field with fewer values.
B.Use the 'maxspan' option to narrow the time window.
C.Use the 'mvlist' option to reduce field storage.
D.Use the 'maxevents' option to limit number of events per transaction.
AnswerA

Correct: Reduces open transactions and improves performance.

Why this answer

High cardinality in the field used by `transaction` causes many open transactions, consuming excessive memory and time. Reducing cardinality (e.g., by using a derived field with fewer unique values) directly addresses this issue. Options B (`maxspan`) and D (`maxevents`) can help limit transactions but do not solve the root cause of high cardinality.

Option C (`mvlist`) is not a valid option for the `transaction` command.

Practice this question →
23
MCQhard

A Splunk administrator notices that a `transaction` command used for correlating VPN login and logout events is consuming excessive memory and causing search timeouts. The transaction groups events by `user` with `maxspan=12h` and `maxpause=30m`. The VPN logs contain millions of events per day. Which design change would most effectively reduce resource consumption while maintaining the ability to correlate logins and logouts within the same session?

A.Remove the maxpause option from the transaction command to simplify grouping.
B.Reduce maxspan to 4h to limit the time window for grouping events.
C.Replace the transaction command with a stats command using earliest and latest functions on the event type.
D.Add maxevents=2 to the transaction command to limit each transaction to exactly two events.
AnswerC

Using `stats earliest(_time) as login, latest(_time) as logout by user` is much more memory efficient and still captures session boundaries.

Why this answer

Replacing `transaction` with `stats` using `earliest` and `latest` eliminates the in-memory event buffering that causes memory exhaustion. `transaction` holds all events in memory until the transaction boundary (maxspan/maxpause) is reached, which is extremely expensive for millions of VPN events. `stats` processes events in a streaming fashion, computing the first and last timestamps per user without storing the full event list, drastically reducing memory and avoiding timeouts.

Exam trap

Splunk often tests the misconception that reducing time windows or event counts in `transaction` solves memory issues, but the real trap is that `transaction` always buffers events in memory, whereas `stats` is a streaming command that avoids this bottleneck entirely.

How to eliminate wrong answers

Option A is wrong because removing `maxpause` would cause the transaction to never close on idle gaps, leading to even larger in-memory buffers and worse memory consumption. Option B is wrong because reducing `maxspan` to 4h only limits the time window but does not address the fundamental issue of `transaction` buffering all events per user in memory; it may still cause memory exhaustion with high event volumes. Option D is wrong because `maxevents=2` assumes exactly one login and one logout per session, but VPN logs may have multiple login attempts or reconnections; this would break correlation for legitimate multi-event sessions and still not reduce memory if events arrive out of order or within the pause window.

Practice this question →
24
MCQmedium

A SOC analyst is investigating a security incident. They use `transaction src_ip` to group firewall events. The search returns too many single-event transactions. The analyst suspects that some events should be grouped but are not because the IP address is used by different sessions. Which option can help ensure events are grouped only if they occur close in time?

A.maxspan=1h
B.maxevents=2
C.fields=src_ip
D.maxpause=5m
AnswerD

maxpause ensures events are only grouped if they occur within 5 minutes of each other, reducing false grouping.

Why this answer

The maxpause option sets the maximum time gap allowed between consecutive events in a transaction. Using a short maxpause helps ensure that events from different sessions are not incorrectly grouped.

Practice this question →
25
MCQmedium

An analyst wants to group events from different sourcetypes (web_access and error_log) into a single transaction when they share the same 'request_id' field and occur within 1 minute. Which search correctly accomplishes this?

A.index=* | transaction request_id maxspan=1m
B.index=main | join type=inner request_id [search sourcetype=error_log]
C.sourcetype=web_access | transaction request_id maxspan=1m | append [search sourcetype=error_log | transaction request_id maxspan=1m]
D.(sourcetype=web_access OR sourcetype=error_log) | transaction request_id maxspan=1m
AnswerD

Correctly combines sourcetypes and groups by request_id within 1 minute.

Why this answer

Using OR to combine sourcetypes and then transaction with maxspan=1m groups events by request_id across both sourcetypes, with a total time limit of 1 minute.

Practice this question →
26
MCQhard

Consider the following search: 'index=web | transaction sessionid maxspan=30m | where eventcount > 5 | stats avg(duration)'. An analyst notices that the search takes a long time and uses excessive memory. Which change would most likely improve performance?

A.Change maxspan to 1h to allow more events.
B.Use the stats command with values(sessionid) instead of transaction.
C.Remove the where clause and use stats after transaction.
D.Add a filter before transaction to reduce events.
AnswerB

Using the stats command with values(sessionid) is a more efficient alternative to transaction because it processes events in a streaming manner without buffering all events of a session in memory. This reduces memory and CPU usage significantly, leading to better performance. While the original query calculates average duration, the stats approach can achieve similar results with less resource consumption.

Why this answer

Using the stats command with values(sessionid) replaces the resource-intensive transaction command. The transaction command buffers all events belonging to the same session within the maxspan window, consuming memory and CPU. The stats command processes events in a more efficient streaming manner, reducing resource usage.

Moreover, by using stats, the search can directly aggregate events by sessionid without requiring a maxspan window or a subsequent where clause, thereby improving performance.

Practice this question →
27
Multi-Selecthard

Which THREE statements about the `transaction` command are true?

Select 3 answers
A.Transaction can correlate events based on more than one field.
B.Transaction events can contain multivalue fields from the constituent events.
C.The maxpause option sets the maximum time span of the transaction.
D.When using startswith and endswith, the transaction event includes a duration field.
E.Transaction is the most efficient way to group events from large datasets.
AnswersA, B, D

Fields can be concatenated or multiple fields specified.

Why this answer

The `transaction` command groups events based on one or more fields (option A true). It can include multivalue fields from constituent events (B true). The `maxpause` option sets the maximum pause between events, not the total time span; the `maxtime` option sets the maximum time span (so C false).

When using `startswith` and `endswith`, a `duration` field is added (D true). Transaction is memory-intensive and not recommended for large datasets, making E false. Therefore, the correct options are A, B, and D.

Practice this question →
28
MCQmedium

A search includes `... | transaction 1,2,3` but returns unexpected results. What does the `1,2,3` represent in this context?

A.Field names to use as transaction keys
B.Three index names to correlate across indexes
C.Status codes for transactions (1=open, 2=pending, 3=closed)
D.maxspan=1s, maxpause=2s, maxevents=3
AnswerD

Positional arguments: maxspan, maxpause, maxevents in seconds.

Why this answer

When the `transaction` command is given three numeric arguments without field names, they are interpreted as `maxspan`, `maxpause`, and `maxevents` respectively. Therefore, `1,2,3` means maxspan=1 second, maxpause=2 seconds, and maxevents=3. Option A is wrong because these are not field names; transaction keys are specified by providing field names as arguments.

Option B is wrong because transaction does not correlate across indexes; it groups events based on fields or time. Option C is wrong because these are not status codes; transaction uses temporal settings and event count limits.

Exam trap

A common trap is thinking that numeric arguments to `transaction` are field names or indexes. In Splunk, when you provide three numbers, they are automatically assigned to maxspan, maxpause, and maxevents without needing to name them.

Practice this question →
29
MCQmedium

Refer to the exhibit. The search is intended to count the number of clients who made more than 3 HTTP requests within any 30-minute window. However, the results are unexpectedly high. What is the most likely reason?

A.The sourcetype does not contain enough methods to satisfy the condition.
B.The stats command should use `dc(clientip)` instead of `count by clientip`.
C.The mvcount function counts the number of unique methods, not events.
D.The same clientip can appear in multiple transactions, causing overcounting.
AnswerD

Each 30-minute window creates a separate transaction; stats count counts each transaction, not unique clients.

Why this answer

The transaction command groups events into transactions based on fields like clientip. If the same clientip appears in multiple transactions (e.g., because the 30-minute window resets or overlaps), that clientip will be counted multiple times in the final stats count. This overcounting inflates the result, making it unexpectedly high.

Exam trap

Splunk often tests the misconception that transaction groups all events for a given field into a single transaction, when in reality it can create multiple transactions per field value if events exceed the maxspan or maxpause limits.

How to eliminate wrong answers

Option A is wrong because the sourcetype's methods are irrelevant to the overcounting issue; the problem is with how transactions group events, not the content of the sourcetype. Option B is wrong because using dc(clientip) would count distinct clientips, which would still be overcounted if the same clientip appears in multiple transactions; the issue is transaction grouping, not the aggregation function. Option C is wrong because mvcount counts the number of values in a multivalue field (like methods), not events; the search uses count by clientip, not mvcount, so this is a misdirection.

Practice this question →
30
MCQeasy

An analyst wants to group events that start with a 'login' event and end with a 'logout' event, using the username field. Which transaction syntax is correct?

A.transaction username startswith=login endswith=logout
B.transaction username startswith="login" endswith="logout" maxspan=2h
C.transaction startswith="login" endswith="logout" by username
D.transaction username startswith="login" endswith="logout"
AnswerD

Correct: Proper syntax.

Why this answer

The proper syntax for grouping events that start with 'login' and end with 'logout' using the username field is 'transaction username startswith="login" endswith="logout"'. Option A lacks quotes around the values, which would cause incorrect parsing. Option B includes an unnecessary 'maxspan=2h' which is not required by the question.

Option C uses 'by username' incorrectly; the field should be placed immediately after 'transaction', not using the 'by' keyword.

Practice this question →
31
Multi-Selectmedium

Which three conditions can cause a transaction to close prematurely? (Choose three.)

Select 3 answers
A.The maxevents value is reached.
B.The startswith event is encountered again.
C.The maxpause value is exceeded.
D.The maxspan value is reached.
E.The endswith event is detected.
AnswersA, C, D

Correct: maxevents closes the transaction when event count reaches limit.

Why this answer

Options A, C, and D are correct. The maxevents (A), maxpause (C), and maxspan (D) settings all cause a transaction to close when their respective limits are reached, potentially before all related events are grouped, which constitutes premature closure. Option B (startswith again) does not close the current transaction; it starts a new transaction, but the previous one may close due to other limits.

Option E (endswith) closes the transaction by design when the endswith event is detected, so it is not considered premature.

Practice this question →
32
Multi-Selecthard

Which THREE conditions must be met for events to be grouped into the same transaction when using the 'transaction' command without any 'startswith' or 'endswith' options? (Choose three.)

Select 3 answers
A.Events must have the same value in the field specified by the 'by' clause.
B.The time difference between the first and last event must not exceed the maxspan value.
C.Events must be from the same sourcetype.
D.The time gap between consecutive events must not exceed the maxpause value.
E.Events must appear in chronological order with no missing timestamps.
AnswersA, B, D

The 'by' clause defines the grouping field.

Why this answer

The 'by' clause in the 'transaction' command defines a field whose value must be identical across all events in a transaction. Without 'startswith' or 'endswith', the transaction command groups events solely based on the 'by' field, the 'maxspan' time window, and the 'maxpause' gap between consecutive events. This ensures that only events sharing the same field value are considered part of the same logical transaction.

Exam trap

The trap here is that candidates often assume events must share the same sourcetype (Option C) because they confuse the 'transaction' command with the 'stats' or 'eventstats' commands, which do not inherently require sourcetype matching, or they mistakenly think chronological order is enforced (Option E) when in fact the command handles ordering internally.

Practice this question →
33
MCQeasy

An analyst wants to correlate events from two different sourcetypes: `auth` logs (login events) and `app` logs (application actions). Both logs share a common `session_id` field. The analyst needs to group all events from the same session, regardless of sourcetype, with a maximum time span of 1 hour. Which search correctly uses the `transaction` command?

A.index=main (sourcetype=auth OR sourcetype=app) | transaction by session_id maxspan=1h
B.index=main (sourcetype=auth OR sourcetype=app) | stats values(*) by session_id, _time
C.index=main (sourcetype=auth OR sourcetype=app) | transaction session_id maxspan=1h
D.index=main sourcetype=auth | append [search index=main sourcetype=app] | transaction session_id maxspan=1h
AnswerC

Correctly groups events by session_id with a 1-hour maxspan.

Why this answer

The `transaction` command groups events that share a common `session_id` field, and the `maxspan=1h` parameter restricts the transaction to a maximum time span of 1 hour. The syntax `transaction session_id maxspan=1h` is valid and ensures all events from both sourcetypes (`auth` and `app`) are correlated into sessions based on the shared field, regardless of sourcetype.

Exam trap

Splunk often tests the subtle syntax difference between `transaction` and `transaction by` — candidates mistakenly add `by` as if it were a `stats` command, but `transaction` takes fields directly without a `by` clause.

How to eliminate wrong answers

Option A is wrong because `transaction by session_id` uses incorrect syntax; the `transaction` command does not accept a `by` clause — it directly takes the field name(s) as arguments. Option B is wrong because `stats values(*) by session_id, _time` does not create transactions; it merely aggregates field values without grouping events into sessions or enforcing a time span. Option D is wrong because using `append` is unnecessary and inefficient; the base search already retrieves both sourcetypes, and `append` does not improve correlation — it simply concatenates results, and the `transaction` command would still work but with redundant overhead.

Practice this question →
34
MCQhard

A Splunk admin notices that a transaction search using the transaction command takes a long time and consumes high memory. The search correlates events by a high-cardinality field (IP address) across multiple indexers. Which optimization technique should be applied first?

A.Use the fields command to remove unnecessary fields before the transaction.
B.Increase maxevents to capture more events per transaction.
C.Use the keepevicted option to retain incomplete transactions.
D.Use the local parameter to force local processing.
AnswerB

Increasing maxevents allows the transaction command to capture more events per transaction, reducing the overhead of managing many partial transactions and improving performance, especially for high-cardinality fields.

Why this answer

The correct optimization technique is to increase maxevents, which allows the transaction command to capture more events per transaction, reducing the number of incomplete transactions and improving performance. The fields command reduces data but does not directly address transaction boundaries. The keepevicted option retains incomplete transactions without optimizing performance.

The local parameter limits parallelism, increasing time and memory usage on a single indexer.

Practice this question →
35
Multi-Selectmedium

A Splunk search uses 'transaction' to correlate events. The transaction times out before all expected events are added. Which TWO options can be adjusted to allow more time for transaction completion? (Choose two.)

Select 2 answers
A.Increase 'maxopentxn'.
B.Set 'connected=false'.
C.Increase 'maxevents'.
D.Decrease 'maxspan'.
E.Increase 'maxtime' in the transaction command.
AnswersC, E

Correct: Allows more events per transaction.

Why this answer

Options C and E are correct. 'maxevents' sets the maximum number of events per transaction; increasing it allows more events to be collected before the transaction times out. 'maxtime' sets the maximum time (in seconds) from the first event to the transaction completion; increasing it gives the transaction more time to complete. Option A ('maxopentxn') controls the maximum number of concurrent open transactions, not the timeout. Option B ('connected=false') changes event grouping behavior and does not extend time.

Option D ('maxspan') defines the maximum time span between earliest and latest event in a transaction; decreasing it would shorten the window and likely cause more timeouts.

Practice this question →
36
MCQmedium

Which command is best for calculating a running total of sales per customer across events without creating a multivalued field?

A.streamstats
B.stats
C.transaction
D.eventstats
AnswerA

streamstats computes windowed functions like running total per group.

Why this answer

(streamstats) is correct because it calculates a running total per customer across events without creating multivalued fields. Option B (stats) aggregates all events into a single result per group, not a running total. Option C (transaction) groups related events but does not compute running totals.

Option D (eventstats) adds aggregate values to each event but not a per-row progression.

Practice this question →
37
MCQmedium

A company wants to correlate events from multiple sources that share a common transaction ID. The events arrive in real time but with variable delays. Which transaction option ensures that a transaction closes after 2 minutes of inactivity?

A.endswith="end"
B.maxspan=2m
C.maxpause=2m
D.startswith="start"
AnswerC

maxpause closes transaction if no matching event arrives within 2 minutes.

Why this answer

Maxpause=2m (Option C). This option specifies the maximum period of inactivity between events in a transaction. When no events matching the transaction are received for 2 minutes, the transaction closes.

This is ideal for correlating events with variable delays because it waits for activity and closes after a quiet period. In contrast, maxspan (option B) sets a total time window from the first event, which would close the transaction regardless of activity after 2 minutes from the start. Options A and D (startswith/endswith) define specific start and end events rather than a timeout.

Thus, maxpause ensures the transaction remains open as long as events arrive within 2 minutes of each other.

Practice this question →
38
MCQmedium

Refer to the exhibit. The eval command combines two fields into one. What is a potential issue with this search?

A.The eval command may cause syntax errors.
B.Transaction does not allow eval before it.
C.The maxspan should be after the transaction command.
D.If an event has both sessionid and correlation_id, the coalesce may create a new value that does not match other events.
AnswerD

coalesce takes the first non-null; if both fields exist but differ, only one is used, potentially breaking grouping.

Why this answer

If an event has both sessionid and correlation_id, the coalesce function will use the first non-null value. However, if the two fields have different values for the same logical session, coalesce may produce a value that does not correspond to any existing field value, causing other events in the transaction to not match. Option A is false because eval syntax is fine.

Option B is false because transaction can be used after eval. Option C is false because maxspan can be placed before transaction.

Practice this question →
39
MCQhard

A transaction search that uses a large maxspan and high-cardinality fields is failing due to memory limitations. Which approach can best reduce memory usage without changing the transaction logic?

A.Use the 'stats' command with values() instead of transaction.
B.Use the 'fields' command before transaction to retain only the correlation fields and _time.
C.Increase the maxpause value to reduce number of open transactions.
D.Set keepevicted=true to offload evicted events.
AnswerB

Correct: minimizes field count.

Why this answer

Using the 'fields' command before 'transaction' to retain only the correlation fields and _time reduces the amount of data held in memory for each event, directly addressing memory limitations. Option A (using 'stats' with values()) changes the logic and does not preserve the event boundary behavior of transaction. Option C (increasing maxpause) does not reduce memory; it may increase the number of concurrent open transactions.

Option D (setting keepevicted=true) actually increases memory usage by keeping evicted events.

Practice this question →
40
MCQhard

A company has events from multiple data sources that share a common 'request_id'. They want to correlate events from different sources (e.g., web, app, database) into a single transaction per request. However, the timestamps across sources are not synchronized, causing some events to appear out of order. Which approach is best to ensure correct grouping?

A.Use `eventstats count by request_id` to correlate counts
B.Use `sort _time | transaction request_id maxspan=10m`
C.Use `transaction request_id` and rely on Splunk to automatically reorder
D.Use `transaction request_id maxspan=1m` and ignore out-of-order events
AnswerB

Sorting by time ensures events are processed in chronological order, and a 10-minute maxspan accommodates timestamp skew.

Why this answer

Setting a larger maxspan and using `sort _time` before transaction can help reorder events, but the most reliable method is to use `transaction request_id` with a generous maxspan and, if needed, use `sort 0 _time` before transaction to ensure time order.

Practice this question →
41
MCQmedium

Refer to the exhibit. What is the purpose of this configuration?

A.It creates a search-time field extraction for clientip and userid.
B.It defines a transaction type that can be used in search with `transaction mytransaction` to group events by clientip and userid with given time parameters.
C.It configures the transaction command to run automatically on all data.
D.It defines a transaction type that can be used in search with `transaction mytransaction` to group events by clientip and userid, ignoring the specified time parameters.
AnswerB

Correct. The stanza in transaction.conf defines a named transaction type (mytransaction) which can be invoked in a search using `transaction mytransaction`. It groups events by clientip and userid and uses the maxpause, maxevents, and other settings to determine transaction boundaries.

Why this answer

This stanza defines a named transaction type in transaction.conf. It can be invoked in a search as `transaction mytransaction` to group events by clientip and userid with the specified time parameters (maxpause, maxevents).

Practice this question →
42
MCQhard

A telecom company monitors call detail records (CDR). Each call has a unique call_id, and events are generated at each network node (setup, ringing, answer, hangup) with timestamps. The events are from different sourcetypes (cdr_setup, cdr_ring, etc.) and are indexed in near real-time. The analyst needs to correlate all events for the same call_id to calculate call duration. The current search is: `index=telecom sourcetype=cdr_* | transaction call_id maxspan=2h`. This search works but sometimes produces huge transactions (100+ events) due to noisy data, causing memory errors. The analyst has identified that each call should have exactly 4 events: setup, ringing, answer, hangup. Which approach would best correlation with minimal resource usage?

A.Use `transaction call_id maxevents=4 maxspan=2h` to limit to exactly 4 events.
B.Use `transaction call_id maxspan=2h` and then filter using `where mvcount(_raw) = 4`.
C.Use `eventstats count by call_id` and then filter.
D.Use `search` with `call_id=*` and then use `streamstats` to calculate duration per call.
AnswerA

Correct: maxevents=4 ensures only the expected events are grouped, reducing memory and processing time.

Why this answer

`maxevents=4` directly limits the transaction to exactly four events per call_id, preventing memory errors from noisy data while ensuring each transaction contains the expected setup, ringing, answer, and hangup events. This constraint is applied during the transaction command itself, reducing resource usage by discarding oversized groups immediately rather than post-processing.

Exam trap

Splunk often tests the misconception that post-filtering (e.g., `where mvcount(_raw) = 4`) is equivalent to using `maxevents`, but the trap is that post-filtering does not prevent memory errors during the transaction assembly phase.

How to eliminate wrong answers

Option B is wrong because `mvcount(_raw) = 4` filters after the transaction command has already built the oversized transactions, meaning memory errors still occur during the transaction phase. Option C is wrong because `eventstats count by call_id` does not correlate events into a single transaction; it only adds a count field to each event, failing to group events for duration calculation. Option D is wrong because `streamstats` operates on a per-event basis without grouping by call_id, so it cannot correlate the four required events to compute call duration.

Practice this question →
43
MCQmedium

Refer to the exhibit. A security analyst notices that some transactions have a duration greater than 600 seconds even though maxpause is set to 5 minutes (300 seconds). What is the most likely reason?

A.The transaction command is including events that are more than 5 minutes apart because the maxpause is ignored when maxspan is set.
B.The eventcount field is inflated, causing duration to be calculated incorrectly.
C.The duration field represents milliseconds, so 600 seconds is actually 0.6 seconds.
D.The maxspan setting of 30 minutes allows the total transaction duration to reach up to 1800 seconds.
AnswerD

Maxspan limits the total elapsed time from first to last event; 600 seconds is within 30 minutes.

Why this answer

The `maxspan` parameter in the transaction command sets an upper limit on the total duration of the transaction from the first to the last event, regardless of the `maxpause` setting. With `maxspan=30m` (1800 seconds), a transaction can have a total duration up to 1800 seconds, even if individual gaps between events exceed `maxpause=5m` (300 seconds). The `maxpause` only limits the idle time between consecutive events, not the overall span, so transactions with gaps larger than 300 seconds but within the 1800-second span are still valid.

Exam trap

Splunk often tests the distinction between `maxpause` and `maxspan`, where candidates mistakenly think `maxpause` alone controls the total transaction duration, ignoring that `maxspan` can extend the overall time window.

How to eliminate wrong answers

Option A is wrong because `maxpause` is not ignored when `maxspan` is set; both parameters work together, with `maxpause` limiting gaps between events and `maxspan` limiting the total transaction duration. Option B is wrong because the `eventcount` field does not affect the calculation of `duration`; `duration` is derived from the timestamps of the first and last events in the transaction, not from event count. Option C is wrong because the `duration` field in the transaction command output is in seconds, not milliseconds; 600 seconds is indeed 600 seconds, not 0.6 seconds.

Practice this question →
44
Drag & Dropmedium

Order the steps to create a workflow action in Splunk.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Workflow actions are created by specifying a label, action type, and URI with field references.

Practice this question →
45
MCQeasy

A security analyst needs to correlate login events with subsequent logout events for the same user session. Which command should be used to group these events together?

A.Use the transaction command with startswith='login' and endswith='logout'.
B.Use the sort command by user and time to manually identify sessions.
C.Use the stats command with values() and earliest().
D.Use the eval command to create a session ID based on time differences.
AnswerA

transaction is designed exactly for this purpose: it groups events that share common fields and satisfy start/end conditions.

Why this answer

The `transaction` command is specifically designed to group related events that share a common field (e.g., user or session ID) and occur within a defined time window. By using `startswith='login'` and `endswith='logout'`, it correctly identifies the beginning and end of a user session, grouping all intermediate events into a single transaction. This is the most direct and efficient method for correlating login and logout events in Splunk.

Exam trap

Splunk often tests the misconception that `stats` or `eval` can replace `transaction` for sessionization, but the trap is that `transaction` is the only command that natively groups events based on a start and end condition without requiring manual time-window calculations or complex field manipulation.

How to eliminate wrong answers

Option B is wrong because the `sort` command only reorders events and does not group them into sessions; manually identifying sessions from sorted data is impractical and error-prone. Option C is wrong because `stats` with `values()` and `earliest()` can aggregate fields but cannot define a transaction boundary based on event types (login/logout) or group intermediate events into a single session. Option D is wrong because `eval` can create a calculated field like a session ID based on time differences, but it lacks the built-in logic to automatically detect start and end events and group all events in between; this would require complex, custom logic that `transaction` handles natively.

Practice this question →
46
MCQeasy

A financial services company uses Splunk to monitor transactions between internal systems. Each transaction consists of a request event and a response event with identical fields: transaction_id, timestamp, component, status. The request event has component='app' and status='request'; the response event has component='db' and status='success' or 'failure'. The analyst runs the following search to correlate them: `index=main (component=app OR component=db) | transaction transaction_id maxspan=30s`. However, they notice that the search takes too long and often times out when there are many transactions. What change would most effectively reduce search time while still correctly grouping request-response pairs?

A.Use `transaction transaction_id maxspan=30s` with a time range picker to limit the search to a smaller time window.
B.Use `stats values(*) as * by transaction_id` and then filter.
C.Use `rename component to type` and then use `transaction`.
D.Use `transaction transaction_id maxevents=2 maxspan=30s`.
AnswerD

Correct: maxevents=2 ensures each transaction contains only the expected two events, reducing memory and processing.

Why this answer

Adding `maxevents=2` limits each transaction to exactly two events (a request and a response), preventing large groupings that cause memory issues and timeouts. The `maxspan=30s` already sets a time window. Option A (using a time range picker) does not address the internal grouping inefficiency.

Option B (`stats values(*) as * by transaction_id`) does not maintain event order and can mix fields, failing to properly correlate request-response pairs. Option C (renaming component to type) does not improve performance.

Practice this question →
47
Multi-Selectmedium

Which TWO statements about the 'transaction' command are correct? (Choose two.)

Select 2 answers
A.It requires all events to be from the same source.
B.It sums numeric field values across events in the transaction.
C.It can use the 'by' clause to group events based on common field values.
D.The 'maxevents' option limits the total number of transactions output.
E.It can combine multiple events into a single event.
AnswersC, E

The 'by' clause is used to specify the field(s) that define a transaction group.

Why this answer

The 'transaction' command can use a 'by' clause to group events that share common field values into a single transaction. This allows you to correlate events from different sources or sourcetypes as long as they have matching field values, enabling flexible event correlation.

Exam trap

Splunk often tests the misconception that 'transaction' aggregates numeric fields (like sum or average) when in reality it only concatenates events, and that 'maxevents' controls the total number of transactions rather than the maximum events per transaction.

Practice this question →
48
MCQhard

An organization has a transaction that groups firewall events by source IP to detect port scans. The transaction uses `maxpause=1m`. Some valid scans are being missed because events occasionally have gaps longer than 1 minute due to network latency. Which change would best capture these scans without introducing too many false positives?

A.Decrease maxspan to 30 seconds
B.Remove maxpause and use only maxspan
C.Group by destination IP instead of source IP
D.Increase maxpause to 2 minutes
AnswerD

Longer pause tolerance captures the scans despite latency, while still closing transactions after gaps.

Why this answer

Increasing maxpause to 2 minutes allows the transaction to tolerate longer gaps between events caused by network latency, ensuring that valid port scans are still captured. This change directly addresses the issue without altering the grouping logic or removing the timeout guard, which would otherwise risk false positives or incorrect grouping.

Exam trap

The trap here is that candidates may think decreasing `maxpause` or removing it entirely will reduce false positives, but in reality, that would increase missed detections (false negatives) without addressing the root cause of latency gaps.

How to eliminate wrong answers

Option A is wrong because decreasing maxspan to 30 seconds would tighten the overall time window, making it even harder to capture scans with latency-induced gaps, thus missing more valid scans. Option B is wrong because removing maxpause and using only maxspan would eliminate the pause tolerance entirely, causing the transaction to close as soon as any gap occurs, which would miss scans with intermittent delays. Option C is wrong because grouping by destination IP instead of source IP changes the correlation logic entirely, which would not address the gap issue and could introduce false positives by correlating unrelated events from different sources to the same destination.

Practice this question →
49
MCQeasy

A user wants to see a single consolidated event for each user session that includes the start time, end time, and total duration. The session events have a 'action' field with values 'start' and 'end' and a common 'user_id'. Which transaction command would achieve this?

A.`transaction user_id startswith=action=start endswith=action=end`
B.`transaction startswith=action=start endswith=action=end`
C.`transaction user_id`
D.`stats values(action) by user_id`
AnswerA

Correctly defines session boundaries using action values.

Why this answer

Using startswith and endswith defines the boundary events, and transaction automatically calculates duration when there are start and end events.

Practice this question →
50
MCQeasy

An analyst wants to group events by 'session_id' but only if the events occur within 5 minutes of each other, and there must be at least 2 events per transaction. Which transaction parameters achieve this?

A.transaction session_id maxspan=300
B.transaction session_id maxspan=300 maxevents=2
C.transaction session_id maxpause=300 minevents=2
D.transaction session_id maxspan=300 minpause=300
AnswerC

Correct: maxpause ensures events are close, minevents ensures at least 2.

Why this answer

Maxpause=300 ensures events are within 5 minutes of each other, and minevents=2 ensures at least 2 events. Option A (maxspan=300) only limits total time. Option B (maxevents=2) limits event count but not grouping window.

Option D (minpause) is not a valid parameter.

Practice this question →
51
Multi-Selectmedium

A security analyst is investigating a series of failed login attempts followed by successful logins from the same IP addresses within short time windows. They want to correlate these events into sessions representing potential brute-force attacks. Which TWO statements accurately describe best practices for using the transaction command in this scenario?

Select 2 answers
A.Transaction command is optimized for correlating events over very long time ranges (over 24 hours).
B.Transaction command requires at least one field to group events into sessions.
C.Transaction command can define transaction boundaries using startswith and endswith conditions.
D.Transaction command can only be used with events that have identical timestamps.
E.Transaction command automatically deduplicates events within a transaction.
AnswersB, C

Correct: A field like src_ip is needed to group related events.

Why this answer

The transaction command requires at least one field (like src_ip) to group events into sessions; without a grouping field, events cannot be correlated. Option C is correct because the transaction command can define transaction boundaries using startswith and endswith conditions, enabling detection of a sequence like failed login followed by successful login. Option A is incorrect because transaction is not optimized for very long time ranges; it can be resource-intensive and is better suited for shorter windows.

Option D is incorrect because transaction does not require identical timestamps; events can span time. Option E is incorrect because transaction does not automatically deduplicate events; you would need the dedup command for that.

Practice this question →
52
MCQhard

A company uses `transaction` to group events by `order_id`. Some orders have many events (1000+). Which option should be added to prevent a single transaction from consuming too many resources?

A.keepevicted=true
B.maxspan=1h
C.maxevents=500
D.maxpause=5m
AnswerC

maxevents caps the number of events per transaction, preventing runaway resource usage.

Why this answer

Maxevents=500. This option limits the number of events that can be included in a single transaction, preventing a transaction with many events (like 1000+) from consuming too many resources. Option A (keepevicted=true) retains evicted events but does not limit resource usage.

Option B (maxspan=1h) limits the time span of the transaction, not the event count. Option D (maxpause=5m) limits the time between events but does not cap the total number of events.

Practice this question →
53
MCQeasy

A security team needs to group all login events from the same user session. Events include 'login' and 'logout' with a common session_id field. Which command should be used to combine these events into a single event per session?

A.join session_id
B.stats by session_id
C.transaction session_id
D.append session_id
AnswerC

Correctly groups events by session_id into a single transaction event.

Why this answer

The `transaction` command is designed to group related events based on common fields and time constraints, making it ideal for combining login and logout events by session_id.

Practice this question →
54
Multi-Selectmedium

Which TWO fields are automatically created by the transaction command? (Select exactly 2 correct answers.)

Select 2 answers
A.total_events
B._endtime
C._starttime
D._time
E.maxpause
AnswersB, C

Correct: transaction adds _endtime.

Why this answer

The transaction command adds _starttime and _endtime fields to each event in the transaction. It also adds duration and eventcount, but those are not listed as options. _time and maxpause are not created by transaction.

Practice this question →
55
Multi-Selecthard

Which TWO conditions can cause a transaction to be evicted?

Select 2 answers
A.Maximum pause between events exceeded
B.Timestamp format mismatch
C.Maximum number of events per transaction reached
D.Transaction has too many fields
E.Search is canceled by user
AnswersA, C

If maxpause is reached, the transaction is closed and evicted from open set.

Why this answer

Correct options: A (Maximum pause between events exceeded) and C (Maximum number of events per transaction reached). These are two conditions that cause a transaction to be evicted. Option B (Timestamp format mismatch) does not cause eviction; it may cause events not to be grouped.

Option D (Transaction has too many fields) is not a standard eviction condition. Option E (Search is canceled by user) stops the search, not evicts a transaction.

Practice this question →
56
MCQmedium

A large e-commerce company uses Splunk to monitor its web application performance. The application logs every HTTP request with fields: `transaction_id`, `url`, `response_time_ms`, `status`. Currently, the team uses the following search to identify slow page loads: `index=web sourcetype=access_combined | transaction transaction_id maxspan=60s | eval total_time = sum(response_time_ms) | where total_time > 5000` However, the search returns no results even though there are known slow pages. The team verified that logs contain `transaction_id` values and that some pages take over 10 seconds. What is the most likely reason the search fails to identify slow pages?

A.The `maxspan=60s` is too short; some page loads may take longer than 60 seconds, causing incomplete transactions.
B.The `transaction` command is grouping by `transaction_id`, but the events might have different transaction_id values for the same page load.
C.The field name is misspelled; it should be `response_time` not `response_time_ms`.
D.The `eval total_time = sum(response_time_ms)` is incorrect because after `transaction`, `response_time_ms` is a multivalue field, and `sum()` does not automatically calculate the sum of multivalue fields.
AnswerD

`sum()` is a statistical function; you need `eval total_time = mvsum(response_time_ms)` or use `stats sum` in a different approach.

Why this answer

After the `transaction` command, `response_time_ms` becomes a multivalue field containing all the individual response times from the events in the transaction. The `sum()` function in `eval` does not automatically aggregate multivalue fields; it requires explicit use of the `mvsum()` function or a `stats sum()` approach. Without this, `total_time` is not calculated correctly, so the `where` clause never matches, returning no results despite slow pages existing.

Exam trap

The trap here is that candidates assume `sum()` in `eval` automatically aggregates multivalue fields, but Splunk's `eval` does not support aggregation functions on multivalue fields without explicit `mv` functions.

How to eliminate wrong answers

Option A is wrong because the search is designed to find slow pages with total time > 5000 ms (5 seconds), and the `maxspan=60s` is more than sufficient to capture transactions that take over 10 seconds; the issue is not the maxspan duration. Option B is wrong because the team verified that logs contain `transaction_id` values and that pages take over 10 seconds, implying the same `transaction_id` is used per page load; if IDs differed, the `transaction` command would simply create separate transactions, not cause zero results. Option C is wrong because the field name `response_time_ms` is explicitly stated in the question as a field in the logs, and there is no evidence of a misspelling; the problem lies in how the field is processed after `transaction`.

Practice this question →
57
MCQeasy

A Splunk admin wants to group events from the same user session in web logs. Which transaction option should be used to ensure the transaction ends after 30 minutes of inactivity?

A.maxpause=30m
B.keepevicted=true
C.maxspan=30m
D.maxevents=100
AnswerA

maxpause ends transaction after 30 minutes of inactivity between events.

Why this answer

Maxpause=30m. The maxpause option specifies the maximum time between events in a transaction; if the pause exceeds this value, the transaction ends. This is ideal for grouping events by user session with a 30-minute inactivity timeout.

Option B (keepevicted=true) retains partial transactions that were evicted from memory, not ending criteria. Option C (maxspan=30m) limits the total time span from the first to the last event, not inactivity. Option D (maxevents=100) limits the number of events in a transaction.

Practice this question →
58
MCQmedium

An analyst wants to find transactions where the first event was a 'login' and the last event was a 'logout'. Which post-transaction filter is correct?

A.where action[0]="login" AND action[-1]="logout"
B.where first(action)="login" AND last(action)="logout"
C.where action="login" AND action="logout"
D.where mvindex(action,0)="login" AND mvindex(action,-1)="logout"
AnswerD

Correct: mvindex accesses elements by position.

Why this answer

The correct filter uses mvindex to access the first and last values of the multivalue 'action' field created by the transaction command. Option A uses invalid array indexing (action[0] is not valid in Splunk). Option B uses nonexistent functions first() and last().

Option C would require a single event to have both values simultaneously, which is impossible. Option D correctly uses mvindex(action,0) for the first event and mvindex(action,-1) for the last event, ensuring the transaction starts with 'login' and ends with 'logout'.

Practice this question →
59
MCQhard

A Splunk administrator notices that the 'transaction' command is consuming excessive memory when processing a large dataset. The dataset contains events with a common field 'user_id', and the goal is to group events per user within 1 hour. Which approach would best reduce memory usage while still achieving the desired correlation?

A.Use the 'kvform' command instead of transaction.
B.Use a subsearch to first filter events and then apply transaction on the smaller set.
C.Add more fields to the transaction to make it more specific.
D.Increase the maxspan value to 2 hours to reduce the number of transactions.
AnswerB

A subsearch can pre-filter or aggregate events, reducing the input size for transaction and thus memory.

Why this answer

Using a subsearch first reduces the dataset size before the 'transaction' command processes it, directly addressing the memory issue. The 'transaction' command groups events into memory until they are finalized, so a smaller input set means fewer events held simultaneously, lowering memory consumption while still allowing the 1-hour maxspan correlation per user_id.

Exam trap

The trap here is that candidates often assume increasing maxspan or adding fields will reduce memory usage, but these actions actually increase the memory footprint or do not address the root cause of excessive data volume.

How to eliminate wrong answers

Option A is wrong because 'kvform' extracts key-value pairs from event data and does not perform event correlation or grouping, so it cannot replace the 'transaction' command's functionality. Option C is wrong because adding more fields to the 'transaction' command increases the specificity of grouping but does not reduce memory usage; in fact, it may increase memory overhead by requiring more comparisons. Option D is wrong because increasing maxspan to 2 hours would allow longer time windows, potentially increasing the number of events grouped per transaction and worsening memory consumption, not reducing it.

Practice this question →
60
Multi-Selectmedium

A Splunk administrator is troubleshooting a search that uses the `transaction` command. The search is taking too long to complete and returning incomplete results. Which TWO changes are most likely to improve performance and accuracy of transaction searches? (Choose TWO.)

Select 2 answers
A.Remove the `maxspan` parameter to allow transactions of any duration.
B.Use `mvcombine` to combine multivalued fields before the transaction.
C.Use `fields` before `transaction` to include only necessary fields.
D.Increase the `maxevents` value to allow more events per transaction.
E.Set an appropriate `maxspan` value based on the expected duration of correlated events.
AnswersC, E

Reduces data volume processed by transaction.

Why this answer

Using the `fields` command before `transaction` reduces the amount of data Splunk must process by retaining only the fields necessary for correlation and output. This minimizes memory and CPU overhead, directly improving search performance and reducing the risk of incomplete results due to resource limits.

Exam trap

Splunk often tests the misconception that increasing limits (like `maxevents` or removing `maxspan`) will improve results, when in fact it exacerbates resource exhaustion and incomplete data.

Practice this question →
61
MCQmedium

A security analyst needs to correlate login events from multiple authentication servers to track a single user session. The events share a common 'session_id' field but have different timestamps. Which transaction command option should be used to ensure the session is considered complete after 30 minutes of inactivity?

A.startswith=login endswith=logout
B.mvlist=session_id
C.maxspan=30m
D.maxpause=1800
AnswerD

maxpause=1800 seconds (30 minutes) closes the transaction after 30 minutes of inactivity.

Why this answer

(maxpause=1800) is correct because it sets a maximum inactivity period of 1800 seconds (30 minutes) between events in a transaction. When no new events with the same session_id arrive within that window, the transaction is considered complete. This directly addresses the requirement to end a session after 30 minutes of inactivity, regardless of the total duration of the session.

Exam trap

The trap here is confusing maxspan (total duration limit) with maxpause (inactivity timeout), leading candidates to choose maxspan=30m when the requirement explicitly calls for an inactivity-based end condition.

How to eliminate wrong answers

Option A is wrong because startswith=login endswith=logout defines explicit start and end events for the transaction, but the requirement is to end based on inactivity, not on a specific logout event. Option B is wrong because mvlist=session_id is not a valid transaction command option; it is used with the stats or eventstats command to create a multivalue field, not to control transaction boundaries. Option C is wrong because maxspan=30m sets a maximum total time span for the entire transaction from first to last event, not a pause or inactivity limit; if events span more than 30 minutes, the transaction is forcibly split, which does not match the requirement of ending after 30 minutes of inactivity.

Practice this question →
62
MCQhard

A security team notices that using `transaction` on a large dataset of firewall logs causes memory issues. Which alternative approach would most efficiently correlate events while reducing resource consumption?

A.Use `concurrency` command to group events
B.Increase `maxtransize` and `maxopentxn` in limits.conf
C.Use `append` with subsearch to join events
D.Use `stats` by session_id list(src_ip), list(dest_ip) with `bin` time
AnswerD

stats consumes less memory than transaction for grouping events.

Why this answer

Using `stats` with `list()` and `bin` time is more memory-efficient than `transaction` for correlating events by session_id. `transaction` creates a transaction object with all event details, consuming more memory, while `stats` aggregates fields without storing raw events. Options A (`concurrency`) is for analyzing concurrent events, not correlation; B (increasing limits) only postpones issues; C (`append`) is for combining results, not efficient correlation.

Practice this question →
63
Multi-Selecthard

A security analyst is writing a search to detect lateral movement across servers by correlating authentication events from multiple domain controllers. Each event has a `user`, `src_ip`, and `dest_ip`. The analyst wants to group events where the same user authenticates from at least 3 different source IPs within 10 minutes. Which TWO components must be part of the search to achieve this? (Choose TWO.)

Select 2 answers
A.Use `transaction user` to group events by user.
B.After the transaction, use `where mvcount(src_ip)>=3` to filter transactions with at least 3 distinct source IPs.
C.Set `maxspan=10m` to limit the grouping window to 10 minutes.
D.Use `maxevents=3` to ensure at least three events per transaction.
E.Use `dedup user` before the transaction to reduce events.
AnswersA, C

Groups events by user for correlation.

Why this answer

Options A and C are correct. The `transaction user` command groups events by user, and `maxspan=10m` limits the grouping window. Option B is incorrect because `mvcount(src_ip)>=3` counts all occurrences of `src_ip`, not distinct IPs, so it does not guarantee that the user authenticated from at least 3 different source IPs.

The correct approach would involve using a different method to ensure distinct IPs, such as removing duplicates within the transaction before counting.

Exam trap

The trap here is that candidates may confuse `maxevents` with the requirement for distinct source IPs, or think that `dedup` is needed to reduce data volume, when in fact it would break the correlation by removing necessary events.

Practice this question →
64
MCQeasy

A Splunk administrator notices that a transaction command is consuming excessive memory and taking too long to complete. The transaction is defined on a field with high cardinality. Which of the following would most effectively reduce memory usage and improve performance?

A.Increase the maxspan value
B.Remove the maxspan constraint
C.Set keepevicted=false
D.Use a different field with lower cardinality for grouping
AnswerD

Lower cardinality means fewer transaction groups, reducing memory and computation.

Why this answer

The transaction command groups events based on field values, and high cardinality fields create many unique groups, each requiring memory for state tracking. Using a lower-cardinality field reduces the number of concurrent groups, directly lowering memory consumption and processing time. This addresses the root cause rather than adjusting timeouts or eviction policies.

Exam trap

The trap here is that candidates often focus on adjusting time-based parameters (maxspan, maxpause) or output options (keepevicted) instead of recognizing that the fundamental issue is the cardinality of the grouping field, which directly drives memory and state management overhead.

How to eliminate wrong answers

Option A is wrong because increasing maxspan allows the transaction to span a longer time window, which can actually increase memory usage by keeping events in memory longer, not reduce it. Option B is wrong because removing the maxspan constraint removes any time boundary, causing the transaction to wait indefinitely for events, which can dramatically increase memory usage and completion time. Option C is wrong because keepevicted=false controls whether evicted (incomplete) transactions are returned, but it does not reduce the memory consumed by the active transaction groups themselves; it only affects output behavior.

Practice this question →
65
MCQmedium

An analyst writes `transaction client_ip` to group events from a firewall. The resulting transactions show many events with duration=0. What is the most likely cause?

A.The client_ip field contains duplicates
B.The transaction option maxspan is set too high
C.The events are not time-stamped properly
D.There is only one event per client_ip in the time range
AnswerD

If only one event exists, the transaction will have duration 0. To avoid this, use startswith/endswith or adjust maxspan.

Why this answer

A duration of 0 often occurs when there is only one event in the transaction. This can happen if the events do not meet the criteria for starting or ending a transaction, or if the maxpause is too short.

Practice this question →
66
MCQhard

A Splunk analyst runs the above search. The results show that some transactions have a duration of 0 seconds. What is the most likely cause?

A.The transaction command failed to group events properly and returned only the login event.
B.The transaction command is processing events out of order, causing login and logout timestamps to be the same.
C.The maxevents=5 limitation causes the transaction to close early, but the logged duration is still calculated correctly from the first event timestamp.
D.Some user sessions are missing a logout event, resulting in a transaction that consists of only a login event, so _time_delta is undefined or zero.
AnswerD

Without a logout event, the transaction may contain only one event, and duration is not calculated, defaulting to 0.

Why this answer

When a transaction lacks an end event (like a logout), the transaction command closes based on other limits (e.g., maxspan, maxpause, or maxevents) and contains only the start event. In such cases, the duration (_time_delta) is calculated from the first event's timestamp to the last event's timestamp; with only one event, the difference is zero or undefined, resulting in a 0-second duration.

Exam trap

Splunk often tests the misconception that a 0-second duration is caused by a grouping or ordering error, when in fact it is a direct result of incomplete transactions (missing end events) within the transaction command's logic.

How to eliminate wrong answers

Option A is wrong because the transaction command groups events correctly based on the fields specified (e.g., user or session ID); a 0-second duration is not caused by a failure to group but by incomplete transactions. Option B is wrong because the transaction command processes events in time order (as indexed) and does not arbitrarily reorder timestamps; if login and logout timestamps were the same, it would indicate simultaneous events, not a processing order issue. Option C is wrong because maxevents=5 limits the number of events in a transaction but does not cause early closure that results in a 0-second duration; the duration is calculated from the first to the last event in the transaction, so if multiple events exist, the duration would be non-zero.

Practice this question →
67
Multi-Selecthard

Which THREE of the following are valid ways to correlate events in Splunk? (Select exactly 3 correct answers.)

Select 3 answers
A.Using the subsearch command.
B.Using the join command with a common field.
C.Using the append command.
D.Using the stats command with values().
E.Using the transaction command with a common field.
AnswersB, D, E

Correct: join correlates events from two datasets.

Why this answer

Transaction groups events based on common fields. Join can correlate events from two searches. Stats with values can also correlate by grouping events into a single result.

Append and subsearch do not perform correlation.

Practice this question →
68
MCQhard

A Splunk admin is troubleshooting a transaction that groups firewall allow and deny events by session ID. The transaction should end when a deny event occurs for that session. Which transaction option should be used to define the end condition?

A.endswith="action=allow"
B.startswith="action=deny"
C.endswith="action=deny"
D.maxevents=2
AnswerC

Correct: This ends the transaction when a deny event is encountered.

Why this answer

'endswith="action=deny"' specifies the event that terminates the transaction when a deny event occurs. Option A 'endswith="action=allow"' would end on an allow event, not the desired deny. Option B 'startswith="action=deny"' would start the transaction on a deny event, not end it.

Option D 'maxevents=2' limits the number of events but does not define a condition based on event content.

Practice this question →
69
Multi-Selecteasy

Which TWO options can be used with the `transaction` command to define the beginning and end of a transaction?

Select 2 answers
A.closed_txn
B.maxpause
C.endswith
D.startswith
E.maxspan
AnswersC, D

Defines the end event.

Why this answer

startswith and endswith define boundary events. maxspan and maxpause are constraints.

Practice this question →
70
MCQeasy

An analyst wants to correlate events from different sourcetypes (e.g., authentication logs and VPN logs) that share a common user field. The goal is to create a single event per user session containing all fields from both sourcetypes. Which command is best suited for this?

A.append
B.union
C.transaction
D.join
AnswerC

Correct: Groups events by common field across sourcetypes.

Why this answer

(transaction). The transaction command groups events from multiple sourcetypes based on a common field (user) and can correlate them into a single event per session, preserving all fields. Options A (append) simply adds events from one search to another without correlation, B (union) combines results from multiple searches without grouping, and D (join) merges events from two datasets based on a common field but does not handle sessionization or multiple sourcetypes as effectively as transaction.

Practice this question →
71
Matchingmedium

Match each Splunk search mode to its behavior.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Optimizes for speed, may skip event data

Balances speed and completeness (default)

Returns all available fields for each event

Searches data as it is indexed

Searches data already indexed

Why these pairings

Search modes control Splunk's behavior: Fast for speed (summary data), Verbose for completeness (all data), Smart as default balance. Common confusions involve swapping these definitions.

Practice this question →
72
MCQeasy

A Splunk search uses 'transaction clientip maxpause=5m'. What does the maxpause setting control?

A.The maximum number of transactions allowed.
B.The maximum number of events in the transaction.
C.The maximum total time span of the transaction.
D.The maximum time gap between events in the transaction.
AnswerD

Correct: maxpause defines the allowed gap between consecutive events.

Why this answer

maxpause sets the maximum inactivity timeout: if no new event for the same clientip arrives within 5 minutes, the transaction is closed.

Practice this question →
73
MCQmedium

A transaction is created using the command: 'index=web status=200 OR status=404 | transaction sessionid'. The user wants to include transactions only if they contain both a 200 and a 404 status. Which additional step achieves this?

A.| transaction sessionid keepevicted=true | where mvcount(status)>=2
B.| where mvcount(mvdedup(status))>=2
C.| search status="200" OR status="404"
D.| where mvcount(status)==2
AnswerB

Correct: Counts distinct status values.

Why this answer

`| where mvcount(mvdedup(status))>=2`. After the initial `transaction` command, each event in a transaction has a multivalue field `status` containing the status codes from all events in that transaction. The goal is to include only transactions that have both a 200 and a 404 status.

Using `mvdedup(status)` removes duplicate status values, then `mvcount()` counts the distinct values. If the count is >=2, it means both statuses are present. Option A uses `keepevicted=true` which is irrelevant; option C is just a search that doesn't filter by transaction; option D counts all occurrences (including duplicates), which could be 2 even if only one status appears twice.

Practice this question →
74
MCQmedium

Refer to the exhibit. A security analyst runs the above search. Which of the following best describes the result?

A.Transactions for all source IPs, but only showing src_ip 10.0.0.1 in the table
B.Transactions of all firewall events for src_ip 10.0.0.1, each lasting up to 5 minutes
C.Transactions of src_ip 10.0.0.1 that start with deny and end with allow
D.Transactions beginning with 'allow' and ending with 'deny' for src_ip 10.0.0.1, with a maximum duration of 5 minutes
AnswerD

Correct interpretation of the transaction parameters.

Why this answer

The transaction command groups events by src_ip=10.0.0.1 with startswith='allow' and endswith='deny' and a maxspan of 5 minutes. This forms transactions that begin with an 'allow' event and end with a 'deny' event within a 5-minute window for that source IP. Option A is incorrect because the search filters events for src_ip 10.0.0.1 only, not all source IPs.

Option B is incorrect because it describes transactions of all firewall events, but the start and end conditions restrict the events filtered. Option C is incorrect because it reverses the start and end conditions (start with deny, end with allow) whereas the search specifies start with allow and end with deny.

Practice this question →
75
MCQhard

A search using the transaction command is producing many partial transactions that are closed due to maxpause, but these transactions are often relevant and should not be discarded. Which option should be added to the transaction command to keep these partial results?

A.keepopen=true
B.keepevicted=true
C.closed=true
D.partial=true
AnswerB

Correct. keepevicted=true retains transactions that are closed due to maxpause.

Why this answer

The keepevicted=true option retains transactions that are closed due to maxpause (i.e., evicted transactions). This ensures that partial but potentially relevant transactions are not discarded and appear in the results. The closed=true option is not a valid parameter for the transaction command.

Practice this question →
Page 1 of 2 · 118 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Transactions and Event Correlation questions.

Start 20-question session