SPLK-1002 Transactions and Event Correlation Practice Question
Which three conditions can cause a transaction to close prematurely? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The maxevents value is reached.
Options A, C, and D are correct. The maxevents (A), maxpause (C), and maxspan (D) settings all cause a transaction to close when their respective limits are reached, potentially before all related events are grouped, which constitutes premature closure. Option B (startswith again) does not close the current transaction; it starts a new transaction, but the previous one may close due to other limits. Option E (endswith) closes the transaction by design when the endswith event is detected, so it is not considered premature.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The maxevents value is reached.
Why this is correct
Correct: maxevents closes the transaction when event count reaches limit.
- ✗
The startswith event is encountered again.
Why it's wrong here
Incorrect: a new startswith may start a new transaction, but the current one closes only if other conditions are met.
- ✓
The maxpause value is exceeded.
Why this is correct
Correct: maxpause closes the transaction if idle time exceeds limit.
- ✓
The maxspan value is reached.
Why this is correct
Correct: maxspan closes the transaction when time limit is reached.
- ✗
The endswith event is detected.
Why it's wrong here
Incorrect: endswith is a planned completion, not premature.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1002 question from scratch — 475 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on SPLK-1002
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO conditions can cause a transaction to be evicted?
hard- ✓ A.Maximum pause between events exceeded
- B.Timestamp format mismatch
- ✓ C.Maximum number of events per transaction reached
- D.Transaction has too many fields
- E.Search is canceled by user
Why A: Correct options: A (Maximum pause between events exceeded) and C (Maximum number of events per transaction reached). These are two conditions that cause a transaction to be evicted. Option B (Timestamp format mismatch) does not cause eviction; it may cause events not to be grouped. Option D (Transaction has too many fields) is not a standard eviction condition. Option E (Search is canceled by user) stops the search, not evicts a transaction.
Variation 2. A Splunk search uses 'transaction clientip maxpause=5m'. What does the maxpause setting control?
easy- A.The maximum number of transactions allowed.
- B.The maximum number of events in the transaction.
- C.The maximum total time span of the transaction.
- ✓ D.The maximum time gap between events in the transaction.
Why D: maxpause sets the maximum inactivity timeout: if no new event for the same clientip arrives within 5 minutes, the transaction is closed.
Variation 3. Which TWO options can be used with the `transaction` command to control how many events are included in a single transaction?
medium- A.mvcount
- ✓ B.maxspan
- C.maxpause
- D.keepevicted
- ✓ E.maxevents
Why B: maxevents limits the number of events per transaction. maxspan limits the time span, indirectly limiting events. maxpause limits the pause between events.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.