Courseiva

CCNA Transactions and Event Correlation Questions

43 of 118 questions · Page 2/2 · Transactions and Event Correlation · Answers revealed

Practice these questionsDomain overviewAll questions
76
MCQeasy

Which transaction option should be used to ensure that a transaction does not exceed a total duration of 10 minutes?

A.endswith="end"
B.maxpause=10m
C.startswith="start"
D.maxspan=10m
AnswerD

Correct. maxspan= sets the maximum total duration allowed for a transaction from start to end.

Why this answer

The correct option is D (maxspan=10m) because maxspan sets the maximum total duration of a transaction from start to end. Option A (endswith) defines the ending event, not duration. Option B (maxpause) limits the maximum pause between events within a transaction.

Option C (startswith) defines the starting event. Therefore, maxspan is used to ensure the entire transaction does not exceed 10 minutes.

Practice this question →
77
MCQeasy

A transaction search is processing too many fields. Which command should be used immediately before the transaction command to reduce memory usage?

A.fields - _raw, _time
B.fields + user_id, _time
C.fields - * except user_id
D.fields user_id, _time
AnswerD

Correct: this keeps only the necessary fields.

Why this answer

The 'fields' command with a positive list (without '+' or '-') sets the field list to exactly those specified, keeping only user_id and _time. This reduces memory usage significantly before the transaction command, which typically needs _time and a grouping field like user_id. Option A is incorrect because removing _raw and _time but keeping other fields does not sufficiently reduce fields; transaction requires _time.

Option B is incorrect because 'fields +' adds fields to the existing set, not replacing them, so it does not reduce memory. Option C is incorrect because 'fields - * except user_id' removes all fields except user_id, but also removes _time, which is essential for the transaction command to correlate events based on time.

Practice this question →
78
MCQhard

Refer to the exhibit. The search returns only transactions that ended with successful login. The administrator wants to see all failed login attempts that did not lead to a success. What is the most efficient approach?

A.Replace the search with | where closed_txn=0.
B.Increase maxpause to 30m.
C.Remove the final search command and instead filter on closed_txn=0.
D.Remove the keepevicted=true option.
AnswerC

With keepevicted=true, evicted (unclosed) transactions have closed_txn=0; filtering on that shows all failed login attempts.

Why this answer

The original search includes a final search command that filters for successful logins. To see all failed login attempts that did not lead to a success, you need to capture evicted transactions (those that closed without success). The most efficient way is to remove the final search command and filter on closed_txn=0.

Option A is incorrect because replacing the search with where closed_txn=0 without removing the final filter would still filter out evicted transactions. Option B is incorrect because increasing maxpause may still not capture all failures and could delay results. Option D is incorrect because removing keepevicted=true would discard the evicted transactions, which are exactly the failures you want to see.

Practice this question →
79
MCQhard

A search uses `transaction session_id maxspan=30m` to group events. The search returns 5000 transaction events. The analyst needs to filter out any transaction that does not contain an event with status=failure. Which post-transaction command should be used?

A.`| transaction session_id maxspan=30m | stats count(eval(status="failure")) by session_id`
B.`| transaction session_id maxspan=30m | search status=failure`
C.`| transaction session_id maxspan=30m | where status=failure`
D.`| transaction session_id maxspan=30m | eval has_failure=if(match(_raw, "failure"),1,0) | where has_failure=1`
AnswerB

Yes, because after transaction, the resulting events have fields from all constituent events; if any constituent had status=failure, the transaction event will have that field. The search filters for transactions that contain at least one such event.

Why this answer

After transaction, you can use `where` with a subsearch or use `search` to filter based on fields within the transaction. Specifically, `search` can be used after transaction to filter events that contain a certain field-value pair.

Practice this question →
80
Multi-Selecthard

Which two techniques should be used to optimize a transaction search that is slow due to a high volume of events? (Choose two.)

Select 2 answers
A.Use the 'fields' command to limit fields before transaction.
B.Use the 'keepevicted' option to free memory.
C.Use the 'stats' command with values() and range() instead of transaction if possible.
D.Use the 'local' parameter to process on a single indexer.
E.Increase the maxspan value to reduce the number of transactions.
AnswersA, C

Correct: reduces memory per event.

Why this answer

Options A and C are correct. Using the 'fields' command before 'transaction' limits the data to only relevant fields, reducing memory and processing overhead. Option C is correct because the 'stats' command with functions like values() and range() can often replace 'transaction' for event correlation, avoiding the resource-intensive transaction command.

Option B is incorrect because 'keepevicted' is used to retain evicted transactions but does not free memory or optimize performance. Option D is incorrect because using the 'local' parameter restricts processing to a single indexer, which can actually harm performance by eliminating parallelism. Option E is incorrect because increasing 'maxspan' expands the time window, potentially increasing the number of events per transaction and worsening performance.

Practice this question →
81
MCQhard

A transaction that groups events by field 'session_id' sometimes produces transactions that contain events from multiple distinct sessions due to session_id reuse over time. What is the best way to ensure transactions are correctly separated?

A.Use 'transaction session_id maxevents=1' to stop after one event.
B.Use 'transaction session_id mvlist=_raw' to include raw data.
C.Use 'transaction session_id maxspan=30m' to limit the time window.
D.Use 'transaction session_id startswith="new_session" endswith="end_session"'.
AnswerC

Correct: Time window separates reused IDs.

Why this answer

Adding a maxspan limits the time window, preventing events from reused session IDs that are widely separated in time from merging into the same transaction. Options A, B, and D do not address the reuse issue effectively: A limits events per transaction but doesn't separate sessions, B includes raw data but doesn't separate, D uses start/end markers which may not be present for all sessions.

Practice this question →
82
MCQhard

A search includes 'transaction userid maxspan=1h maxopentxn=1000'. What is the purpose of maxopentxn?

A.It limits the total number of transactions in the search results.
B.It limits the number of transactions that can be open simultaneously in memory.
C.It limits the number of events per transaction.
D.It limits the time span of open transactions.
AnswerB

Correct. `maxopentxn` limits the number of transactions that can be open simultaneously in memory. When the limit is reached, the oldest idle transaction is closed to free memory.

Why this answer

The `maxopentxn` parameter in the `transaction` command limits the number of transactions that can be open at the same time in memory. Once this limit is reached, the transaction with the longest idle time is closed forcefully. This prevents excessive memory usage when many transactions are in progress.

It does not directly limit the total number of transactions in the final results, nor does it limit events per transaction or time span of open transactions.

Exam trap

A common trap is confusing `maxopentxn` with `maxtxn`, which limits the total number of transactions in the output. `maxopentxn` is a memory management setting, not a result limiter.

Practice this question →
83
MCQhard

An administrator runs a transaction command that groups events by a customer ID but notices that some transactions are missing expected events. The log shows that the events are present and within the maxpause. What could be the reason?

A.Events are from different hosts or sources.
B.The startswith and endswith are conflicting.
C.The fields option is missing.
D.The maxpause value is too short.
AnswerA

By default, transaction groups by host, source, and sourcetype; events from different hosts are not grouped.

Why this answer

The transaction command, by default, groups events not only by the specified 'by' fields but also by host, source, and sourcetype. If events for the same customer ID originate from different hosts or sources, they are treated as separate transactions. This explains why some transactions are missing expected events despite the events being present and within the maxpause.

Option A correctly identifies this common pitfall. Option B is incorrect because startswith and endswith define transaction boundaries and do not conflict here. Option C is incorrect because the 'fields' option is not required; without it, the default grouping includes host and source, which causes the issue.

Option D is incorrect because the maxpause is explicitly stated to be adequate.

Practice this question →
84
MCQeasy

A Splunk Power User needs to find the average duration of user sessions. The sessions are defined by a 'user_id' field and have a max inactivity of 15 minutes. Which search correctly calculates this?

A.index=main | transaction user_id maxpause=15m | stats avg(duration)
B.index=main | transaction user_id maxpause=15m | eval avg=avg(duration)
C.index=main | transaction user_id maxpause=15 | stats avg(_time)
D.index=main | transaction user_id maxspan=15m | stats avg(duration)
AnswerA

Correct: transaction adds duration, stats averages it.

Why this answer

The transaction command with maxpause=15m groups events by user_id and adds a duration field. The stats command then calculates the average duration.

Practice this question →
85
MCQeasy

A security analyst wants to group all authentication events (e.g., login, logout, failure) that occur within a 10-minute window for each user. The events are from multiple sources and share a common 'user' field. Which transaction command is most appropriate?

A.... | transaction user maxspan=600 maxevents=100
B.... | transaction user maxpause=120
C.... | transaction user maxspan=600 startswith="login" endswith="logout"
D.... | transaction user maxspan=600
AnswerD

Correct: maxspan sets a 10-minute window.

Why this answer

'maxspan=600' limits the transaction time window to 600 seconds (10 minutes), which meets the requirement of grouping events within 10 minutes for each user. There's no need for startswith/endswith as all authentication events should be included. Option A is incorrect because 'maxevents=100' may truncate transactions with more than 100 events.

Option B is incorrect because 'maxpause=120' only sets a pause threshold but does not enforce a total time limit; transactions could exceed 10 minutes if events continue with short pauses. Option C is incorrect because using startswith and endswith restricts the transaction to only those that begin with 'login' and end with 'logout', potentially excluding other authentication events like failures.

Practice this question →
86
Multi-Selecteasy

Which three statements about the transaction command are correct? (Choose three.)

Select 3 answers
A.The transaction command automatically adds an 'eventcount' field.
B.The transaction command requires a startswith or endswith parameter.
C.The transaction command can only correlate events within the same sourcetype.
D.The transaction command automatically adds a 'duration' field.
E.The transaction command can be used with events from different indexes.
AnswersA, D, E

Correct. The transaction command adds an ‘eventcount’ field that counts the number of events in each transaction.

Why this answer

Options A, D, and E are correct. The transaction command automatically adds the 'eventcount' and 'duration' fields to each result. It can also correlate events from different indexes, as it uses fields like ‘_time’ and a group-by field; there is no restriction that all events must come from the same index.

Option B is false because startswith/endswith are optional; transaction can also use a field-based group (e.g., by session_id). Option C is false because transaction can correlate events from different sourcetypes.

Practice this question →
87
MCQhard

A large e-commerce company is using Splunk to monitor user sessions across multiple microservices. Each service logs events with a common 'session_id' field. The security team wants to identify sessions where a user performed a 'password_change' action followed by a 'login' from a different IP address within 5 minutes, indicating possible account takeover. The current search uses `transaction session_id startswith=action=login endswith=action=password_change maxspan=10m`. However, the search returns very few results, and the team suspects it is missing many attacks. The logs show that sometimes 'password_change' occurs before 'login' (e.g., password reset then login) and the IP changes are observed across multiple events. The team needs to capture both orderings. Which approach should they take?

A.Use `transaction session_id maxspan=5m` and then filter for sessions that contain both actions
B.Use `transaction session_id startswith=action=password_change endswith=action=login maxspan=5m` in a separate search and append results
C.Keep the current search but increase maxspan to 30m
D.Add both startswith and endswith with OR conditions: `startswith=(action=login OR action=password_change) endswith=(action=login OR action=password_change)`
AnswerA

This captures any order within 5 minutes, then filter for both actions.

Why this answer

The current search only captures one order (login then password_change). To capture both orders, they should either use `transaction session_id maxspan=5m` without startswith/endswith and then filter, or use two separate transactions and combine. The best option is to use `transaction session_id maxspan=5m` and then search for events where both actions occur, because it avoids order dependency and is simpler.

Practice this question →
88
MCQhard

Refer to the exhibit. An analyst sees that the transaction for sessionid 'abc123' has duration 120 seconds and 4 events. The events within this transaction occur at 10:00:00, 10:01:00, 10:02:00, and 10:03:00. Why did the transaction close?

A.The transaction closed because there were only 4 events.
B.The maxpause of 5 minutes was exceeded; there was no event after 10:03:00 for more than 5 minutes.
C.The transaction closed because the maxopentxn limit was reached.
D.The maxspan of 10 minutes was reached.
AnswerB

Correct: maxpause timeout caused closure.

Why this answer

Since maxpause=5m is specified, the transaction closed 5 minutes after the last event (10:03:00) at approximately 10:08:00, but because maxspan is 10m, the 2-minute duration is well under that. The close was due to the inactivity timeout.

Practice this question →
89
MCQhard

A security operations center (SOC) uses Splunk to correlate alerts from multiple sources. They have a rule that triggers a transaction when an IDS alert is followed within 5 minutes by a firewall deny event from the same source IP. The search is: `index=security sourcetype=ids OR sourcetype=firewall | transaction src_ip startswith="ids" endswith="firewall" maxspan=5m`. This works well when the deny event occurs after the alert. However, analysts are missing correlations where the firewall deny event occurs slightly before the IDS alert (up to 1 minute before). To capture these out-of-order events without significantly increasing resource usage, what should the analyst do?

A.Use `reverse` before transaction to process events in reverse time order.
B.Increase maxspan to 6 minutes and add `maxevents=2`.
C.Use `sort` with time dimension and then use `eventstats` to mark pairs.
D.Use `transaction src_ip maxspan=6m` without startswith/endswith and then filter for events with both sourcetypes.
AnswerD

Using `transaction src_ip maxspan=6m` without `startswith` and `endswith` groups all events from the same source IP within 6 minutes, regardless of order. This includes the IDS alert and firewall deny pair, which can then be isolated by filtering for both sourcetypes.

Why this answer

Using `transaction src_ip maxspan=6m` without `startswith` and `endswith` groups all events from the same source IP within 6 minutes. This captures the pair regardless of order (IDS alert before firewall or firewall before IDS). A subsequent filter for events with both sourcetypes isolates the desired pair.

This approach does not significantly increase resource usage because the `maxspan` limits the time window. Option B fails because `transaction` still requires the `startswith` event to occur before the `endswith` event; if the firewall deny comes first, the IDS alert is not the start, so no transaction is created. Option A (`reverse`) has no effect as `transaction` internally sorts events by time.

Option C (`sort` and `eventstats`) does not group events into transactions, making it unsuitable for correlation.

Exam trap

The trap is that increasing `maxspan` does not fix out-of-order events when using `startswith` and `endswith`; those conditions enforce chronological order.

Practice this question →
90
MCQeasy

A Splunk administrator at a company with 500 employees needs to correlate VPN login events with subsequent network access logs to track user sessions. The VPN logs contain fields: user, src_ip, timestamp, event_type (login or logout). The network logs contain fields: user, dst_ip, timestamp, action (allow or deny). Both logs are indexed daily. The administrator wants to create a search that groups each VPN login with all network access events from that user within the next 8 hours. However, the current search using `transaction user startswith="login" endswith="logout" maxspan=8h` is returning many incomplete transactions where the logout event is missing. What is the most efficient way to improve the correlation without missing sessions?

A.Use a different approach: `... | stats values(*) as * by user, time_bucket | ...` with bucket times.
B.Change to `transaction user maxspan=8h` and remove startswith/endswith.
C.Use `transaction user startswith="login" endswith="logout" maxspan=8h keepevicted=true`.
D.Use `transaction user maxspan=8h maxevents=100` and filter manually.
AnswerC

Correct: keepevicted=true outputs incomplete transactions, including those missing logout.

Why this answer

Adding keepevicted=true to the transaction command causes Splunk to output incomplete transactions (those missing the logout event) as evicted transactions. This allows the analyst to see all sessions, including those where the logout was not recorded, preventing missing data. Option A uses stats with time buckets, which does not properly group events into sessions.

Option B removes startswith and endswith, so it would group all events of the same user within 8 hours, potentially merging separate sessions inaccurately. Option D uses maxevents=100, which may still drop sessions if they have many events, and manual filtering is inefficient.

Practice this question →
91
MCQeasy

A Splunk user wants to group web server logs into transactions representing a single user visit, where a visit starts with a 'GET' request and ends with a 'POST' request. Which transaction command syntax correctly implements this logic?

A.transaction startswith="GET" endswith="POST" maxevents=2
B.transaction startswith="POST" endswith="GET"
C.transaction startswith="GET" endswith="POST"
D.transaction by src_ip startswith="GET" endswith="POST"
AnswerC

Correct. `transaction startswith="GET" endswith="POST"` groups events into a transaction that begins with a GET request and ends with a POST request, matching the requirement for a single user visit without unnecessary constraints.

Why this answer

The `transaction` command with `startswith="GET"` and `endswith="POST"` correctly groups events into a transaction that begins with a GET request and ends with a POST request, matching the requirement for a single user visit. Options A and D add unnecessary constraints (`maxevents=2` or `by src_ip`) that alter the intended grouping logic, and option B reverses the start and end events, which does not match the specified visit flow.

Exam trap

Splunk often tests the misconception that `maxevents` is required to limit transaction size, but here the trap is that candidates add unnecessary constraints (like `maxevents=2` or `by src_ip`) that alter the intended grouping logic, or they reverse the `startswith` and `endswith` values, failing to match the required visit flow.

How to eliminate wrong answers

Option A is wrong because `maxevents=2` artificially limits the transaction to exactly two events, which may exclude intermediate events (e.g., additional GETs, POSTs, or other HTTP methods) that occur between the start and end of a real user visit. Option B is wrong because it reverses the start and end conditions (startswith="POST" endswith="GET"), which would group transactions that begin with a POST and end with a GET, the opposite of the required user visit flow. Option D is wrong because adding `by src_ip` groups transactions per source IP, which is unnecessary for the basic logic and could cause transactions to be split incorrectly if the same user visit spans multiple IPs (e.g., due to NAT or proxy) or if multiple users share the same IP.

Practice this question →
92
MCQeasy

Refer to the exhibit. The search returns no transactions even though there are login and logout events in the index. What is the most likely cause?

A.The maxpause value is too short.
B.The startswith and endswith options are mispelled.
C.The sourcetype is incorrect.
D.The transaction command may be timing out due to large data volume.
AnswerD

Without limiting fields, the transaction may consume too much memory, causing the search to be killed.

Why this answer

When the transaction command processes a large volume of data, it may exceed the default memory or time limits, causing the search to complete without returning any results. This is a common issue with transaction, especially when there are many events to correlate. Option A is incorrect because the maxpause value is not specified in the exhibit; if it were too short, events close together might be missed, but no transactions at all suggests a different problem.

Option B is incorrect because any misspelling in startswith or endswith would typically prevent the search from running or cause syntax errors. Option C is incorrect because the sourcetype appears to be present in the events; the issue is not about missing sourcetype.

Practice this question →
93
MCQhard

A financial services company uses Splunk to detect fraudulent transactions. Each transaction event has fields: `user_id`, `amount`, `merchant`, `timestamp`. The fraud detection team wants to identify users who make multiple small transactions (under $50) totaling over $200 within a 1-hour window, which may indicate testing stolen credit cards. They write the following search: `index=transactions sourcetype=payment amount<50 | transaction user_id maxspan=1h | where sum(amount) > 200` This search runs but returns no results, even though manual inspection shows users with such patterns. What is the primary reason the search fails?

A.The `amount<50` filter is applied before the transaction, which excludes amounts exactly $50.
B.The search lacks a `fields` command to include `user_id`, so the transaction fails.
C.The `maxspan=1h` is too short; users might spread transactions over more than 1 hour.
D.The `where sum(amount) > 200` does not work as expected because `sum()` is not an aggregation function in that context; you need to use `stats sum(amount)` or `eval total=mvsum(amount)` first.
AnswerD

`sum()` in `where` does not aggregate multivalue fields; it returns the sum of the first value.

Why this answer

The `transaction` command creates a single multivalue field `amount` containing all amounts from the grouped events. The `where` clause cannot directly aggregate multivalue fields with `sum()`; it requires an explicit `eval` to compute the sum (e.g., `eval total=mvsum(amount)`) or a `stats` command. Without this, the `where` clause evaluates `sum(amount)` as a string operation or fails silently, returning no results.

Exam trap

The trap here is that candidates assume `sum(amount)` works directly in a `where` clause after `transaction`, but Splunk requires explicit multivalue field aggregation functions like `mvsum()` to compute totals from grouped events.

How to eliminate wrong answers

Option A is wrong because the `amount<50` filter correctly excludes transactions of exactly $50, but the problem states the search returns no results even though patterns exist; the issue is not about boundary values. Option B is wrong because the `transaction` command automatically groups events by `user_id` and retains all fields from the original events; no `fields` command is needed to include `user_id`. Option C is wrong because the search explicitly looks for patterns within a 1-hour window, and the problem confirms such patterns exist; the `maxspan=1h` is not the cause of zero results.

Practice this question →
94
MCQhard

A security team wants to detect a multi-step attack pattern: a user logs in from a new IP address, then within 10 minutes performs a privilege escalation, and finally accesses a sensitive file. They have events with fields: user, ip, action, and timestamp. Which SPL transaction statement should they use to group these three events into one transaction, ensuring all three actions occur in order?

A.`transaction user,ip,action maxspan=10m`
B.`transaction user maxspan=10m`
C.`transaction user maxpause=30s`
D.`transaction user mvcount=3`
AnswerB

Groups by user within a 10-minute window, allowing the sequence to be verified later.

Why this answer

`transaction user maxspan=10m` groups all events from the same user that occur within a 10-minute window. The events are inherently ordered by timestamp, so the three actions (login, privilege escalation, sensitive file access) will appear in chronological order within the transaction, satisfying the requirement. Including `action` or `ip` in the transaction fields would split the three different actions or IP addresses into separate transactions, preventing detection of the complete pattern.

Exam trap

Splunk often tests the misconception that `transaction` requires all specified fields to match exactly, leading candidates to include `action` in the transaction fields, which would incorrectly split the three different actions into separate transactions.

How to eliminate wrong answers

Option A is wrong because including `ip` and `action` in the `transaction` fields means the transaction will only group events that share the exact same `ip` and `action` values, which would prevent grouping the three different actions (login, privilege escalation, file access) together since they have different `action` values. Option C is wrong because `maxpause=30s` sets a maximum idle time between events in the transaction, but does not enforce a total time limit of 10 minutes; the attack pattern requires all three events to occur within 10 minutes, not just a 30-second pause between them. Option D is wrong because `mvcount=3` is not a valid parameter for the `transaction` command; `mvcount` is used with `stats` or `eventstats` to count multivalue fields, not to group events into transactions.

Practice this question →
95
MCQeasy

A Splunk admin wants to group events that share a common `session_id` field. Events arrive out of order. Which transaction field will automatically sort events correctly?

A.sort=_time
B.Use option `timeordered=true`
C.transaction automatically sorts by time
D.No sorting needed; events are indexed in order
AnswerC

transaction groups and orders events by _time within each group.

Why this answer

`transaction` automatically sorts events by time within each transaction. Option A (sort) is not a transaction option. Option B (index order) is not guaranteed.

Option D (timeordered) is not a valid option.

Practice this question →
96
MCQmedium

An analyst needs to correlate events from a web server log and an application log to identify failed login attempts followed within 5 seconds by an error event. The events share a common session ID field. Which approach should the analyst use?

A.Use `transaction sessionID maxspan=5s` to group events by session ID within 5 seconds
B.Use `append` to combine the two sourcetypes and then `search` for the pattern
C.Use `eventstats` to compute counts by sessionID and then filter
D.Use `stats` with values() and a by clause on sessionID
AnswerA

Transaction groups events sharing the sessionID field and limits the span to 5 seconds, allowing pattern detection.

Why this answer

The `transaction` command is designed to group related events based on shared field values (sessionID) within a specified time boundary (maxspan=5s). This allows the analyst to correlate web server and application log events that share the same session ID and occur within 5 seconds, making it straightforward to identify failed login attempts followed by an error event.

Exam trap

Splunk often tests the misconception that `stats` or `eventstats` can perform event correlation, but these commands aggregate data and lose the individual event sequence required for time-ordered correlation within a specific window.

How to eliminate wrong answers

Option B is wrong because `append` simply concatenates results from two searches without any correlation logic; it does not group events by session ID or enforce a time window. Option C is wrong because `eventstats` computes aggregate statistics (like counts) but does not group individual events into transactions or enforce a 5-second span. Option D is wrong because `stats` with `values()` and a `by` clause aggregates field values per session ID but loses the individual event sequence and time ordering needed to detect a failed login followed by an error within 5 seconds.

Practice this question →
97
MCQeasy

Refer to the exhibit. What is the purpose of the 'maxpause=5m' parameter in this search?

A.It limits the number of events in a transaction to 5.
B.It limits the total time span of each transaction to 5 minutes.
C.It pauses the search for 5 minutes between transactions.
D.It closes the transaction if there is no new event from the same clientip within 5 minutes.
AnswerD

Correct: maxpause is the inactivity timeout.

Why this answer

maxpause sets the inactivity timeout: if no new event from the same clientip arrives within 5 minutes, the transaction is closed.

Practice this question →
98
MCQhard

Refer to the exhibit. The search aims to detect brute-force attacks where there are at least 2 failed logins followed by a successful login from the same source IP within 5 minutes. However, the search returns no results even though such attacks exist. What is the most likely error in the search logic?

A.The transaction should group by user instead of src.
B.The case statement does not set stage for events that don't match either pattern.
C.The mvcount(stage) condition is incorrectly checking for >2 and >=2 simultaneously.
D.The `search stage="*"` command is filtering out all transactions because stage is a multivalue field.
AnswerD

Searching stage="*" does not match multivalue fields; it matches a literal asterisk. Should use `where isnotnull(stage)`.

Why this answer

The `search stage="*"` command filters out all transactions because `stage` is a multivalue field created by the `transaction` command. In Splunk, a multivalue field cannot be matched with a simple wildcard search like `stage="*"`; this search only returns events where `stage` is a single literal asterisk. To search for any value in a multivalue field, you must use `mvcount(stage)>0` or `search stage=*` (without quotes).

Exam trap

Splunk often tests the subtle difference between `field="*"` (literal asterisk) and `field=*` (wildcard) in the context of multivalue fields, tricking candidates into thinking a quoted wildcard works the same as an unquoted one.

How to eliminate wrong answers

Option A is wrong because the search already groups by `src` (source IP), which is the correct field for detecting brute-force attacks from the same IP; grouping by `user` would miss attacks where the same IP tries multiple usernames. Option B is wrong because the `case` statement does set `stage` for events that match either pattern (failed or successful login), and events that don't match either pattern are irrelevant to the attack detection and can be ignored. Option C is wrong because `mvcount(stage)>2` and `mvcount(stage)>=2` are not mutually exclusive; the condition `mvcount(stage)>2 AND mvcount(stage)>=2` is redundant but not logically incorrect—it would still match transactions with 3 or more events, but the real issue is that the preceding `search` command eliminates all transactions before this condition is evaluated.

Practice this question →
99
MCQeasy

A security analyst wants to group all events from a single web session into one transaction. The session is identified by a 'sessionId' field, and events are generated over a period that can last up to 30 minutes. The analyst also wants to close the transaction if there is no activity for more than 10 minutes. Which transaction parameters should be used?

A.maxspan=30m, maxpause=5m
B.maxspan=10m, maxpause=30m
C.maxspan=1h, maxpause=10m
D.maxspan=30m, maxpause=10m
AnswerD

Correctly sets total duration and inactivity timeout.

Why this answer

The maxspan parameter sets the maximum total duration of the transaction, while maxpause sets the inactivity timeout. Option D correctly specifies maxspan=30m (to cover the maximum session length) and maxpause=10m (to close the transaction after 10 minutes of inactivity).

Practice this question →
100
Multi-Selectmedium

Which TWO statements correctly describe the behavior of the transaction command in Splunk?

Select 2 answers
A.It is not recommended for use with large datasets because it consumes too much memory.
B.It merges all fields from all events into a single event, with the last event's field value taking precedence.
C.It can concatenate the raw text of all events in the transaction into a single event.
D.It automatically calculates the duration of each transaction as the difference between the first and last event timestamps.
E.It can close a transaction based on a change in a specific field value or after a specified timeout.
AnswersC, E

The transaction command can combine raw event text from all related events into one event.

Why this answer

The transaction command can be configured with the `mvraw` option to concatenate the raw text of all events in the transaction into a single event. This is useful when you need to preserve the full log lines of a correlated sequence, such as a multi-step user session or a series of API calls.

Exam trap

The trap here is that candidates often confuse the transaction command's field merging behavior (which creates multivalue fields) with the `stats values()` function, or assume duration is automatically calculated without the `duration` option, leading them to select option B or D incorrectly.

Practice this question →
101
MCQmedium

A Splunk user wants to correlate events from different sourcetypes (web_access, app_log) that belong to the same user session identified by session_id. The events should be grouped only if they occur within 30 minutes of each other, and each transaction should contain at least one event from each sourcetype. Which SPL construct should they use?

A.`append [search sourcetype=app_log]` then sort by session_id
B.`transaction session_id maxspan=30m`
C.`sourcetype=web_access OR sourcetype=app_log | eval session=session_id` then `stats values(*) as * by session`
D.`join type=inner session_id [search sourcetype=app_log]` after a search on web_access
AnswerB

Transaction groups events by session_id within 30 minutes, fulfilling both requirements.

Why this answer

The `transaction` command groups events that share a common field (`session_id`) and allows you to set constraints like `maxspan=30m` to limit the time window between the first and last event in the transaction. However, `transaction` does not automatically require events from both sourcetypes; grouping is based solely on the session_id field. To ensure each transaction contains at least one event from both `web_access` and `app_log`, you would need to add a subsequent filter, such as `| where mvcount(sourcetype) > 1`.

Nevertheless, option B is the correct construct because it groups events by session_id within the time window, and the additional requirement can be applied afterward. The other options fail to enforce the 30-minute window or the presence of both sourcetypes.

Exam trap

Splunk often tests the distinction between `transaction` and `stats` or `join`; the trap here is that candidates mistakenly think `stats` can group events with time constraints, but `stats` lacks the ability to enforce a `maxspan` or require events from multiple sourcetypes within the same group.

How to eliminate wrong answers

Option A is wrong because `append` simply adds results from a second search to the main results without any grouping or correlation logic; it does not group events by session_id or enforce a 30-minute span. Option C is wrong because `stats values(*) as * by session` aggregates all fields into multivalue lists but does not enforce a time window or require that each group contains events from both sourcetypes; it also renames fields in a way that loses sourcetype context. Option D is wrong because `join type=inner` on `session_id` performs a field-based join that requires exact matches on the session_id field, but it does not impose a 30-minute time constraint and does not group events into a single transaction; it merely pairs matching events row-by-row.

Practice this question →
102
MCQeasy

A security team needs to group login events for the same user within a 5-minute window. Which transaction option should be used to limit the time between consecutive events?

A.maxspan
B.maxpause
C.startswith
D.endswith
AnswerB

maxpause limits the idle time between events in a transaction.

Why this answer

(maxpause) is correct because maxpause limits the maximum time between consecutive events in a transaction. Option A (maxspan) limits the total duration of the transaction from first to last event. Option C (startswith) defines a condition to start a transaction.

Option D (endswith) defines a condition to end a transaction.

Practice this question →
103
Multi-Selecthard

Which TWO of the following are valid reasons to use transaction instead of stats for event correlation?

Select 2 answers
A.When you need to preserve the full events for each group.
B.When working with very large datasets.
C.When you need to enforce a time window between events.
D.When you need faster search performance.
E.When events come from different sourcetypes.
AnswersA, C

transaction returns all original events within each group.

Why this answer

Options A and C are correct. The transaction command is used when you need to preserve the full events for each group (A), which stats does not do (it produces statistical results). Additionally, transaction allows you to enforce a time window between events, such as maxspan or maxpause (C).

Option B is false because stats is more efficient for very large datasets; transaction can be resource-intensive. Option D is false because stats typically provides faster performance due to lower overhead. Option E is false because both commands can handle events from multiple sourcetypes; that is not a distinguishing factor.

Practice this question →
104
MCQhard

Refer to the exhibit. An analyst runs the above search to test transaction behavior. What is the likely result?

A.One transaction with 5 events, avg duration ~50s
B.One transaction with 5 events, avg duration ~10s
C.Multiple transactions, each with fewer events, avg duration less than 10s
D.No transactions created because events are out of order
AnswerC

Correct. Events are split into multiple transactions because the random timestamps are spread beyond 10 seconds. Each transaction has fewer events and average duration less than 10s.

Why this answer

The search uses `transaction` with `maxspan=10s`. The random timestamps are spread over up to 100 seconds, so events that are more than 10 seconds apart cannot be in the same transaction. Thus, the events will be split into multiple transactions, each containing a subset of the events.

The average duration of these transactions will be well under 10 seconds, making option C correct. Option A is incorrect because not all 5 events can fit into one 10-second window. Option B is incorrect for the same reason.

Option D is incorrect because transactions are still created for events that do fall within a 10-second window.

Exam trap

Candidates often assume that `maxspan` prevents transactions entirely, but it actually splits events into multiple transactions.

Practice this question →
105
MCQmedium

A large e-commerce site logs all user page views and purchases. Each event contains user_id, session_id, timestamp, and event_type (view or purchase). The marketing team wants to analyze the sequence of views that lead to a purchase. They use `transaction session_id startswith="view" endswith="purchase" maxspan=1h`. However, they find that some transactions are missing purchase events because the purchase occurs after 1 hour, or sometimes multiple purchases occur within the same session. To include all related events and correctly identify the sequence leading to each purchase, what is the best approach?

A.Use `stats list(event_type) by session_id` with time sorting to reconstruct the sequence.
B.Use `transaction session_id startswith="view" endswith="purchase" maxspan=1h keepevicted=true` to see partial sequences.
C.Increase maxspan to 24h to capture all potential purchases.
D.Use `transaction user_id maxspan=1h` without startswith/endswith to group all events.
AnswerA

Correct: stats list maintains event order per session and naturally handles multiple purchases and any time span.

Why this answer

Using `stats list(event_type) by session_id` with a sort on timestamp preserves the order of events and handles multiple purchases and variable time spans without the limitations of the transaction command. Option B (keepevicted=true) still requires a start and end for each purchase, missing scenarios where purchase occurs after the window. Option C (increase maxspan to 24h) would still break on multiple purchases and increase memory usage.

Option D (group by user_id) loses session distinction and may merge separate sessions.

Practice this question →
106
MCQmedium

A search uses `transaction` with wildcard fields (e.g., `*id`), causing poor performance. What is the best practice to optimize this?

A.Specify exact field names instead of wildcards
B.Use `transaction *id, nullif=null`
C.Increase maxopentxn in limits.conf
D.Replace transaction with stats
AnswerA

Transaction matches fields exactly; wildcards slow down because Splunk must evaluate multiple fields.

Why this answer

Using specific field names instead of wildcards reduces the overhead of matching multiple fields, improving transaction performance. Option B is invalid syntax; `nullif` is not a transaction option here. Option C increases limits but does not address the root cause of wildcard inefficiency.

Option D changes the approach to `stats`, which may not preserve transaction boundaries.

Practice this question →
107
Drag & Dropmedium

Order the steps to set up a data input for monitoring a log file in Splunk.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Adding a file monitor involves selecting the input type, specifying the file, and configuring source type and index.

Practice this question →
108
MCQeasy

A search uses transaction to group login and logout events. What happens if a user has multiple logins before logging out?

A.The search will fail due to overlapping transactions.
B.The transaction will include the first login and all events until the first logout.
C.It will create multiple transactions for each login.
D.It will ignore the first login and start at the last login.
AnswerB

startswith begins at the first match, ends at first endswith after that.

Why this answer

The transaction command with startswith/endswith groups events from the first occurrence of the start condition to the first occurrence of the end condition. If a user logs in multiple times before logging out, the transaction will include only the first login event and all subsequent events (including subsequent logins) until the first logout event. Subsequent login events are included in the same transaction but do not start new transactions.

Therefore, the correct answer is B. Option A is incorrect because the search does not fail; it simply groups events as described. Option C is incorrect because only one transaction is created for that user, not multiple.

Option D is incorrect because the first login is not ignored; it is the start of the transaction.

Practice this question →
109
Multi-Selectmedium

Which TWO options can be used with the `transaction` command to control how many events are included in a single transaction?

Select 2 answers
A.mvcount
B.maxspan
C.maxpause
D.keepevicted
E.maxevents
AnswersB, E

Indirectly limits events by time.

Why this answer

maxevents limits the number of events per transaction. maxspan limits the time span, indirectly limiting events. maxpause limits the pause between events.

Practice this question →
110
Multi-Selecteasy

Which TWO of the following are limitations of the transaction command in Splunk?

Select 2 answers
A.It cannot be used inside an eval statement.
B.It only works with indexed fields.
C.It defaults to a maximum of 1000 events per transaction.
D.It cannot correlate events from multiple sourcetypes.
E.It can consume significant memory and processing resources.
AnswersC, E

The default maxevents is 1000.

Why this answer

The transaction command defaults to a maximum of 1000 events per transaction. If a transaction exceeds this limit, Splunk will close the transaction and start a new one, which can lead to incomplete or unexpected results. This limit can be increased using the maxevents argument, but it is a key constraint to be aware of when correlating large sequences of events.

Exam trap

The trap here is that candidates often assume the transaction command can only use indexed fields or cannot cross sourcetypes, but Splunk's transaction command is flexible with any search-time field and can correlate across multiple sourcetypes, making options B and D common distractors.

Practice this question →
111
MCQhard

A large enterprise runs Splunk Enterprise with 500 servers forwarding Windows security logs. The security team wants to correlate failed logins (EventCode 4625) with subsequent successful logins (EventCode 4624) from the same source IP within a 5-minute window. They currently use the following search: index=windows sourcetype=WinEventLog:Security (EventCode=4625 OR EventCode=4624) | transaction src_ip maxpause=5m | search EventCode=4625 AND EventCode=4624. This search is extremely slow and often times out. Which approach would improve performance while maintaining the same correlation logic?

A.Use the append command to combine the two event types after separate searches.
B.Add maxevents=1000 to the transaction command to limit event count.
C.Increase maxpause to 10 minutes to allow more events per transaction.
D.Replace transaction with a combination of stats and where that groups by src_ip and then filters for pairs.
AnswerD

Using stats with values and where reduces memory overhead and improves performance.

Why this answer

Using stats and where is more efficient than transaction. Transaction holds all events in memory until the transaction is closed, which is memory-intensive when dealing with many events like 500 servers. The stats command can group events by src_ip, then the where command can filter for pairs of EventCode 4625 and 4624 within the same group.

This approach leverages streaming capabilities and reduces memory overhead. Option A is incorrect because the append command does not correlate events by source IP; it merely concatenates results from two separate searches. Option B is incorrect because adding maxevents=1000 (already default) limits the number of events per transaction but does not address the underlying memory consumption issue of transaction.

Option C is incorrect because increasing maxpause to 10 minutes would allow more events per transaction, making the search even slower and more prone to timeout.

Practice this question →
112
MCQhard

A team wants to correlate events from different sourcetypes (web, db) on a common `sessionid`. They use `transaction sessionid` across both sourcetypes. The results show that some transactions are missing events. What is the most likely cause?

A.The search is running at 'info' level instead of 'verbose'
B.Timestamps from different sourcetypes are misaligned
C.maxevents is set too low
D.sessionid field has different names in each sourcetype
AnswerB

Correct. When sourcetypes have different timestamp formats or time zones, events may be incorrectly ordered or fall outside the default transaction window, causing some events to be missing from the transaction.

Why this answer

Sourcetypes may have different timestamp formats or time zones, causing events to be incorrectly sorted out of the transaction window. Option C (maxevents) would truncate but not miss events. Option D (field name) is unlikely.

Option A (search time level) is not relevant.

Practice this question →
113
MCQhard

A large e-commerce company uses Splunk to analyze customer purchase funnels. Their environment includes 10 indexers and a search head cluster. They have a search that runs every 5 minutes to correlate events from web logs, order logs, and payment logs using the `transaction` command on a common `order_id` field. The search uses `transaction order_id maxevents=50 maxspan=30m`. Recently, users have reported that some orders are missing from the results, especially for high-volume periods. The team also notices that dashboard searches often timeout. They suspect the transaction command is the bottleneck. Upon examining the search, they see that the web logs alone generate hundreds of events per order. Which course of action would best address the missing orders and performance issues?

A.Increase maxevents to 200 and increase search timeout
B.Remove maxpause and set maxspan to 60m
C.Reduce maxevents to 10 to limit resource usage
D.Replace transaction with stats by order_id, using list() for relevant fields and evaluating event order separately
AnswerD

Using stats is more memory-efficient and does not have maxevents limits; it can aggregate all events per order without eviction, and performance improves because it avoids the overhead of tracking open transactions.

Why this answer

The `transaction` command is resource-intensive and can cause timeouts and missing data when `maxevents` is exceeded. Increasing `maxevents` (A) would worsen performance. Removing `maxpause` and increasing `maxspan` (B) does not address the `maxevents` limit and may keep transactions open longer.

Reducing `maxevents` (C) would exacerbate missing orders. Replacing `transaction` with `stats ... list() by order_id` groups fields without holding open transactions, avoiding the `maxevents` constraint and reducing resource usage, thus addressing both missing orders and performance issues.

Practice this question →
114
MCQeasy

Refer to the exhibit. A Splunk user runs the search shown. The search returns results, but the user notices that some clientip values appear multiple times in the stats output, even though they should have been grouped into a single transaction. What is the most likely reason for this?

A.The sourcetype filter is excluding some events.
B.The stats command is not correctly summing the counts.
C.The maxspan is too short to capture all events for each clientip.
D.The maxevents option prevents more than 5 events from being grouped into one transaction, so additional events form separate transactions.
AnswerD

maxevents=5 limits the number of events per transaction, causing fragmentation.

Why this answer

The `transaction` command's `maxevents` option limits the maximum number of events that can be grouped into a single transaction. When more than 5 events exist for a given `clientip`, the extra events cannot be included in the first transaction and instead form separate transactions, causing the same `clientip` to appear multiple times in the `stats` output.

Exam trap

The trap here is that candidates often assume `maxevents` only limits the number of events per transaction but forget that exceeding this limit causes the creation of additional transactions for the same grouping field, leading to duplicate identifiers in aggregated output.

How to eliminate wrong answers

Option A is wrong because the sourcetype filter is not excluding events; the search returns results, so all relevant events are present. Option B is wrong because the `stats` command correctly sums counts; the issue is that multiple transactions are created for the same `clientip`, not a miscalculation. Option C is wrong because the `maxspan` is not mentioned in the search; the problem is caused by `maxevents=5`, not by a time-based constraint.

Practice this question →
115
Multi-Selectmedium

Which TWO of the following are valid ways to correlate events without using the transaction command?

Select 2 answers
A.Using append to combine events from two searches
B.Using join to merge events on transactionID
C.Using sort to order events by transactionID
D.Using eventstats to compute counts per transactionID
E.Using stats ... by transactionID
AnswersD, E

eventstats adds aggregate values to each event, linking them.

Why this answer

Options D and E are correct. Using stats ... by transactionID groups events by a common field and computes aggregate values, effectively correlating events. Using eventstats to compute counts per transactionID adds a calculated aggregate to each event, correlating events with the same transactionID.

Both are valid correlation methods without using the transaction command. Options A and B (append and join) combine results from separate searches but do not correlate events in the same sense, and sort (C) merely orders events.

Practice this question →
116
MCQeasy

An analyst runs `sourcetype=access_combined | transaction clientip` and notices many single-event transactions. Which option would help close transactions more accurately?

A.Add `endswith="status=200"`
B.Increase maxpause to 1 hour
C.Do nothing; single events are fine
D.Set closedelay=10
AnswerA

endswith ensures transaction closes when a logout or end event occurs.

Why this answer

Adding `endswith` helps define when a transaction should close, reducing false single-event transactions (e.g., 200 status often indicates end). Option B (maxpause) might help but not as targeted. Option C (closedelay) is not valid.

Option D (null) is not helpful.

Practice this question →
117
MCQhard

A Splunk administrator is correlating events from two sourcetypes using transaction with startswith and endswith. The transaction rarely matches events even though they exist. What is the most likely cause?

A.The maxpause value is too high.
B.Events from the two sourcetypes are not in chronological order.
C.The fields option is missing.
D.The startswith and endswith patterns are too broad.
AnswerB

Events must be sorted by time; if sourcetypes have different timestamps, transaction may fail to correlate.

Why this answer

The most likely cause is that events from the two sourcetypes are not in chronological order. The transaction command, by default, requires events to be processed in time order, and if events from different sourcetypes are interleaved or out of sequence, the transaction may fail to match a complete sequence. Option A is incorrect because a high maxpause would make the transaction more likely to match, not less.

Option C is incorrect because the fields option is not required for the transaction to work; it is used to identify the transaction. Option D is incorrect because overly broad patterns would cause too many matches, not too few.

Practice this question →
118
MCQmedium

An analyst uses transaction to group web requests by session_id. Some transactions are unexpectedly large, containing hundreds of events. What parameter should be adjusted to limit the number of events per transaction?

A.maxspan
B.maxpause
C.mvcount
D.maxevents
AnswerD

Correct: maxevents caps the number of events per transaction.

Why this answer

Maxevents limits the number of events in a transaction. Option A (maxspan) limits the maximum time span of the transaction. Option B (maxpause) limits the maximum pause between events.

Option C (mvcount) is used to count multivalue fields, not to limit event count.

Practice this question →
← PreviousPage 2 of 2 · 118 questions total

Ready to test yourself?

Try a timed practice session using only Transactions and Event Correlation questions.

Start 20-question session