Transactions and Event Correlation →hardMultiple ChoiceObjective-mapped

SPLK-1002 Transactions and Event Correlation Practice Question

Exhibit

Search: index=web | transaction sessionid maxspan=10m maxpause=5m | table _time, sessionid, duration, eventcount
Result:
_time                sessionid   duration  eventcount
2024-01-15 10:00:00  abc123      120        4
2024-01-15 10:15:00  def456      60         2
2024-01-15 10:30:00  ghi789      300        10

Refer to the exhibit. An analyst sees that the transaction for sessionid 'abc123' has duration 120 seconds and 4 events. The events within this transaction occur at 10:00:00, 10:01:00, 10:02:00, and 10:03:00. Why did the transaction close?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The maxpause of 5 minutes was exceeded; there was no event after 10:03:00 for more than 5 minutes.

Since maxpause=5m is specified, the transaction closed 5 minutes after the last event (10:03:00) at approximately 10:08:00, but because maxspan is 10m, the 2-minute duration is well under that. The close was due to the inactivity timeout.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The transaction closed because there were only 4 events.
Why it's wrong here
No event count limit is set.
✓
The maxpause of 5 minutes was exceeded; there was no event after 10:03:00 for more than 5 minutes.
Why this is correct
Correct: maxpause timeout caused closure.
✗
The transaction closed because the maxopentxn limit was reached.
Why it's wrong here
No indication of such a limit.
✗
The maxspan of 10 minutes was reached.
Why it's wrong here
Duration is 2 minutes, well below maxspan.

Go deeper

SPLK-1002 Transactions and Event Correlation Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question