Transactions and Event Correlation →hardMultiple ChoiceObjective-mapped

SPLK-1002 Transactions and Event Correlation Practice Question

Exhibit

Refer to the exhibit.
```spl
index=security sourcetype=authentication 
| transaction user startswith="Failed login" endswith="Successful login" maxpause=10m keepevicted=true
| search duration>0
```

Refer to the exhibit. The search returns only transactions that ended with successful login. The administrator wants to see all failed login attempts that did not lead to a success. What is the most efficient approach?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Remove the final search command and instead filter on closed_txn=0.

The original search includes a final search command that filters for successful logins. To see all failed login attempts that did not lead to a success, you need to capture evicted transactions (those that closed without success). The most efficient way is to remove the final search command and filter on closed_txn=0. Option A is incorrect because replacing the search with where closed_txn=0 without removing the final filter would still filter out evicted transactions. Option B is incorrect because increasing maxpause may still not capture all failures and could delay results. Option D is incorrect because removing keepevicted=true would discard the evicted transactions, which are exactly the failures you want to see.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Replace the search with | where closed_txn=0.
Why it's wrong here
closed_txn is not a standard field; evicted transactions have a closed_txn field of 0 only if keepevicted is true, but the search still filters duration>0.
✗
Increase maxpause to 30m.
Why it's wrong here
Increasing maxpause may keep more events but does not guarantee that all failed logins are captured as separate transactions.
✓
Remove the final search command and instead filter on closed_txn=0.
Why this is correct
With keepevicted=true, evicted (unclosed) transactions have closed_txn=0; filtering on that shows all failed login attempts.
✗
Remove the keepevicted=true option.
Why it's wrong here
Without keepevicted, evicted transactions are dropped, so failures would be lost.

Go deeper

SPLK-1002 Transactions and Event Correlation Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question