Why Transaction Returns No Results: Memory Timeout Causes
Exhibit
Refer to the exhibit. ```spl index=web sourcetype=access_combined | transaction sessionid startswith="GET /login" endswith="GET /logout" maxpause=5m ```
Refer to the exhibit. The search returns no transactions even though there are login and logout events in the index. What is the most likely cause?
Quick Answer
The correct answer is that the transaction command may be timing out due to large data volume. This occurs because transaction, by default, includes all fields from each event, and when processing a high volume of login and logout events, the memory required to hold these fields can exceed the search head’s memory limit, causing the command to silently fail and return no results. On the Splunk SPLK-1003 exam, this scenario tests your understanding of how transaction’s memory consumption differs from commands like stats or eventstats, which only retain specified fields; a common trap is assuming the syntax or maxpause is at fault when the real issue is hidden memory exhaustion. To remember this, think: “Transaction takes everything, so memory can sting.”
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The transaction command may be timing out due to large data volume.
When the transaction command processes a large volume of data, it may exceed the default memory or time limits, causing the search to complete without returning any results. This is a common issue with transaction, especially when there are many events to correlate. Option A is incorrect because the maxpause value is not specified in the exhibit; if it were too short, events close together might be missed, but no transactions at all suggests a different problem. Option B is incorrect because any misspelling in startswith or endswith would typically prevent the search from running or cause syntax errors. Option C is incorrect because the sourcetype appears to be present in the events; the issue is not about missing sourcetype.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The maxpause value is too short.
Why it's wrong here
5 minutes is typically sufficient for login/logout flows.
- ✗
The startswith and endswith options are mispelled.
Why it's wrong here
They are spelled correctly.
- ✗
The sourcetype is incorrect.
Why it's wrong here
The sourcetype is given as access_combined, which is valid.
- ✓
The transaction command may be timing out due to large data volume.
Why this is correct
Without limiting fields, the transaction may consume too much memory, causing the search to be killed.
Go deeper
Related to this question
About these practice questions
One of 475 original SPLK-1002 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SPLK-1002
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. A Splunk user runs the search shown. The search returns results, but the user notices that some clientip values appear multiple times in the stats output, even though they should have been grouped into a single transaction. What is the most likely reason for this?
easy- A.The sourcetype filter is excluding some events.
- B.The stats command is not correctly summing the counts.
- C.The maxspan is too short to capture all events for each clientip.
- ✓ D.The maxevents option prevents more than 5 events from being grouped into one transaction, so additional events form separate transactions.
Why D: The `transaction` command's `maxevents` option limits the maximum number of events that can be grouped into a single transaction. When more than 5 events exist for a given `clientip`, the extra events cannot be included in the first transaction and instead form separate transactions, causing the same `clientip` to appear multiple times in the `stats` output.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.