Correct Syntax for the Splunk Transaction Command
An analyst wants to correlate events from two different sourcetypes: `auth` logs (login events) and `app` logs (application actions). Both logs share a common `session_id` field. The analyst needs to group all events from the same session, regardless of sourcetype, with a maximum time span of 1 hour. Which search correctly uses the `transaction` command?
Quick Answer
The correct answer is `index=main (sourcetype=auth OR sourcetype=app) | transaction session_id maxspan=1h` because the `transaction` command groups events sharing a common field—here, `session_id`—into a single multievent transaction, and the `maxspan=1h` parameter enforces a one-hour time boundary between the first and last event in the group. This syntax is valid because `transaction` does not require a `sourcetype` argument; it correlates events across any sourcetypes as long as they share the specified field. On the SPLK-1003 exam, this question tests your understanding that `transaction` is used for sessionization across disparate data sources, and a common trap is confusing it with `stats` or `eventstats`, which require explicit aggregation functions. A key memory tip: think of `transaction` as a "field-based glue" that sticks events together by a common ID, while `maxspan` sets the maximum time window for that glue to hold.
⚠ Common exam trap
Splunk often tests the subtle syntax difference between `transaction` and `transaction by` — candidates mistakenly add `by` as if it were a `stats` command, but `transaction` takes fields directly without a `by` clause.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
index=main (sourcetype=auth OR sourcetype=app) | transaction session_id maxspan=1h
The `transaction` command groups events that share a common `session_id` field, and the `maxspan=1h` parameter restricts the transaction to a maximum time span of 1 hour. The syntax `transaction session_id maxspan=1h` is valid and ensures all events from both sourcetypes (`auth` and `app`) are correlated into sessions based on the shared field, regardless of sourcetype.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
index=main (sourcetype=auth OR sourcetype=app) | transaction by session_id maxspan=1h
Why it's wrong here
`transaction` uses fields directly, not a `by` clause; this syntax is invalid.
- ✗
index=main (sourcetype=auth OR sourcetype=app) | stats values(*) by session_id, _time
Why it's wrong here
`stats` does not create transaction groupings; it aggregates values.
- ✓
index=main (sourcetype=auth OR sourcetype=app) | transaction session_id maxspan=1h
Why this is correct
Correctly groups events by session_id with a 1-hour maxspan.
- ✗
index=main sourcetype=auth | append [search index=main sourcetype=app] | transaction session_id maxspan=1h
Why it's wrong here
`append` is unnecessary and performance-inefficient; a single search with OR is better.
Go deeper
Related to this question
About these practice questions
One of 475 original SPLK-1002 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
5 more ways this is tested on SPLK-1002
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An analyst needs to correlate events from a web server log and an application log to identify failed login attempts followed within 5 seconds by an error event. The events share a common session ID field. Which approach should the analyst use?
medium- ✓ A.Use `transaction sessionID maxspan=5s` to group events by session ID within 5 seconds
- B.Use `append` to combine the two sourcetypes and then `search` for the pattern
- C.Use `eventstats` to compute counts by sessionID and then filter
- D.Use `stats` with values() and a by clause on sessionID
Why A: The `transaction` command is designed to group related events based on shared field values (sessionID) within a specified time boundary (maxspan=5s). This allows the analyst to correlate web server and application log events that share the same session ID and occur within 5 seconds, making it straightforward to identify failed login attempts followed by an error event.
Variation 2. A security analyst is investigating a series of failed login attempts followed by successful logins from the same IP addresses within short time windows. They want to correlate these events into sessions representing potential brute-force attacks. Which TWO statements accurately describe best practices for using the transaction command in this scenario?
medium- A.Transaction command is optimized for correlating events over very long time ranges (over 24 hours).
- ✓ B.Transaction command requires at least one field to group events into sessions.
- ✓ C.Transaction command can define transaction boundaries using startswith and endswith conditions.
- D.Transaction command can only be used with events that have identical timestamps.
- E.Transaction command automatically deduplicates events within a transaction.
Why B: The transaction command requires at least one field (like src_ip) to group events into sessions; without a grouping field, events cannot be correlated. Option C is correct because the transaction command can define transaction boundaries using startswith and endswith conditions, enabling detection of a sequence like failed login followed by successful login. Option A is incorrect because transaction is not optimized for very long time ranges; it can be resource-intensive and is better suited for shorter windows. Option D is incorrect because transaction does not require identical timestamps; events can span time. Option E is incorrect because transaction does not automatically deduplicate events; you would need the dedup command for that.
Variation 3. An analyst wants to correlate events from different sourcetypes (e.g., authentication logs and VPN logs) that share a common user field. The goal is to create a single event per user session containing all fields from both sourcetypes. Which command is best suited for this?
easy- A.append
- B.union
- ✓ C.transaction
- D.join
Why C: (transaction). The transaction command groups events from multiple sourcetypes based on a common field (user) and can correlate them into a single event per session, preserving all fields. Options A (append) simply adds events from one search to another without correlation, B (union) combines results from multiple searches without grouping, and D (join) merges events from two datasets based on a common field but does not handle sessionization or multiple sourcetypes as effectively as transaction.
Variation 4. A security analyst wants to group all authentication events (e.g., login, logout, failure) that occur within a 10-minute window for each user. The events are from multiple sources and share a common 'user' field. Which transaction command is most appropriate?
easy- A.... | transaction user maxspan=600 maxevents=100
- B.... | transaction user maxpause=120
- C.... | transaction user maxspan=600 startswith="login" endswith="logout"
- ✓ D.... | transaction user maxspan=600
Why D: 'maxspan=600' limits the transaction time window to 600 seconds (10 minutes), which meets the requirement of grouping events within 10 minutes for each user. There's no need for startswith/endswith as all authentication events should be included. Option A is incorrect because 'maxevents=100' may truncate transactions with more than 100 events. Option B is incorrect because 'maxpause=120' only sets a pause threshold but does not enforce a total time limit; transactions could exceed 10 minutes if events continue with short pauses. Option C is incorrect because using startswith and endswith restricts the transaction to only those that begin with 'login' and end with 'logout', potentially excluding other authentication events like failures.
Variation 5. An analyst wants to ensure that a transaction is only considered complete when it contains a specific end event. Which transaction parameter should be used?
easy- A.startswith
- ✓ B.endswith
- C.maxpause
- D.maxspan
Why B: The endswith parameter specifies the event that marks the end of a transaction. Option A (startswith) defines the start event. Option C (maxpause) sets the maximum idle time between events. Option D (maxspan) sets the maximum total duration of the transaction.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.