SPLK-1002 Transactions and Event Correlation Practice Question
Exhibit
index=web sourcetype=access_combined | transaction clientip maxspan=30m maxpause=5m | table clientip, duration, eventcount | where duration > 600
Refer to the exhibit. A security analyst notices that some transactions have a duration greater than 600 seconds even though maxpause is set to 5 minutes (300 seconds). What is the most likely reason?
⚠ Common exam trap
Splunk often tests the distinction between `maxpause` and `maxspan`, where candidates mistakenly think `maxpause` alone controls the total transaction duration, ignoring that `maxspan` can extend the overall time window.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The maxspan setting of 30 minutes allows the total transaction duration to reach up to 1800 seconds.
The `maxspan` parameter in the transaction command sets an upper limit on the total duration of the transaction from the first to the last event, regardless of the `maxpause` setting. With `maxspan=30m` (1800 seconds), a transaction can have a total duration up to 1800 seconds, even if individual gaps between events exceed `maxpause=5m` (300 seconds). The `maxpause` only limits the idle time between consecutive events, not the overall span, so transactions with gaps larger than 300 seconds but within the 1800-second span are still valid.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The transaction command is including events that are more than 5 minutes apart because the maxpause is ignored when maxspan is set.
Why it's wrong here
Maxpause is not ignored; both settings are enforced.
- ✗
The eventcount field is inflated, causing duration to be calculated incorrectly.
Why it's wrong here
Eventcount does not affect duration calculation.
- ✗
The duration field represents milliseconds, so 600 seconds is actually 0.6 seconds.
Why it's wrong here
Duration is in seconds, not milliseconds.
- ✓
The maxspan setting of 30 minutes allows the total transaction duration to reach up to 1800 seconds.
Why this is correct
Maxspan limits the total elapsed time from first to last event; 600 seconds is within 30 minutes.
Go deeper
Related to this question
About these practice questions
One of 475 original SPLK-1002 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.