SPLK-1002 Transactions and Event Correlation Practice Question
Exhibit
Refer to the exhibit. ``` sourcetype=access_combined | transaction clientip maxspan=30m | where mvcount(method) > 3 | stats count by clientip ```
Refer to the exhibit. The search is intended to count the number of clients who made more than 3 HTTP requests within any 30-minute window. However, the results are unexpectedly high. What is the most likely reason?
⚠ Common exam trap
Splunk often tests the misconception that transaction groups all events for a given field into a single transaction, when in reality it can create multiple transactions per field value if events exceed the maxspan or maxpause limits.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The same clientip can appear in multiple transactions, causing overcounting.
The transaction command groups events into transactions based on fields like clientip. If the same clientip appears in multiple transactions (e.g., because the 30-minute window resets or overlaps), that clientip will be counted multiple times in the final stats count. This overcounting inflates the result, making it unexpectedly high.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The sourcetype does not contain enough methods to satisfy the condition.
Why it's wrong here
The sourcetype is access_combined which typically has many methods.
- ✗
The stats command should use `dc(clientip)` instead of `count by clientip`.
Why it's wrong here
Using dc(clientip) would count distinct clientip values, but the issue is multiple transactions per client.
- ✗
The mvcount function counts the number of unique methods, not events.
Why it's wrong here
mvcount(method) counts the number of method values in the multivalue field, which is the number of events in the transaction.
- ✓
The same clientip can appear in multiple transactions, causing overcounting.
Why this is correct
Each 30-minute window creates a separate transaction; stats count counts each transaction, not unique clients.
Go deeper
Related to this question
About these practice questions
One of 475 original SPLK-1002 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.