Understanding Transaction Command Parameters and Grouping Conditions
Which THREE conditions must be met for events to be grouped into the same transaction when using the 'transaction' command without any 'startswith' or 'endswith' options? (Choose three.)
Quick Answer
When the transaction command is used without startswith or endswith, it has no explicit event-content markers telling it where a transaction begins or ends, so it falls back entirely on structural conditions: the by field, the maxspan window, and the maxpause gap. The by clause requires that grouped events share an identical value for the specified field, which is what ties individual events to a single logical transaction. maxspan then bounds the total duration a transaction is allowed to span from its first event to its last, and maxpause independently limits how much time can elapse between any two consecutive events in that same transaction before it's considered closed. All three checks have to pass simultaneously; events matching on the by field but arriving more than maxpause apart, or spanning longer than maxspan in total, get split into separate transactions even though they share the same field value. This distinction between a gap-based limit and a total-duration limit is easy to blur, so it's worth remembering maxpause governs consecutive-event gaps while maxspan governs the whole transaction's length. Any exam question describing transaction grouping without startswith or endswith is testing whether you can identify these three structural conditions rather than any content-based boundary.
⚠ Common exam trap
Candidates often assume events must share the same sourcetype (Option C) because they confuse the 'transaction' command with the 'stats' or 'eventstats' commands, which do not inherently require sourcetype matching, or they mistakenly think chronological order is enforced (Option E) when in fact the command handles ordering internally.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Events must have the same value in the field specified by the 'by' clause.
The 'by' clause in the 'transaction' command defines a field whose value must be identical across all events in a transaction. Without 'startswith' or 'endswith', the transaction command groups events solely based on the 'by' field, the 'maxspan' time window, and the 'maxpause' gap between consecutive events. This ensures that only events sharing the same field value are considered part of the same logical transaction.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Events must have the same value in the field specified by the 'by' clause.
Why this is correct
The 'by' clause defines the grouping field.
- ✓
The time difference between the first and last event must not exceed the maxspan value.
Why this is correct
maxspan limits the total duration of the transaction.
- ✗
Events must be from the same sourcetype.
Why it's wrong here
Transaction can correlate across different sourcetypes.
- ✓
The time gap between consecutive events must not exceed the maxpause value.
Why this is correct
maxpause ensures events are close together in time.
- ✗
Events must appear in chronological order with no missing timestamps.
Why it's wrong here
Transaction handles events in order based on _time, but missing timestamps are not a requirement.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1002 question from scratch — 475 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on SPLK-1002
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO options are valid parameters of the `transaction` command?
medium- A.timeformat
- ✓ B.maxpause
- C.sequential
- ✓ D.keepevicted
- E.fieldlist
Why B: Correct options: B (maxpause) and D (keepevicted). Option A (timeformat) is for time parsing, not transaction. Option C (sequential) is not a valid parameter of the `transaction` command. Option E (fieldlist) is not a parameter; fields are given as arguments.
Variation 2. A company wants to correlate events from multiple sources that share a common transaction ID. The events arrive in real time but with variable delays. Which transaction option ensures that a transaction closes after 2 minutes of inactivity?
medium- A.endswith="end"
- B.maxspan=2m
- ✓ C.maxpause=2m
- D.startswith="start"
Why C: Maxpause=2m (Option C). This option specifies the maximum period of inactivity between events in a transaction. When no events matching the transaction are received for 2 minutes, the transaction closes. This is ideal for correlating events with variable delays because it waits for activity and closes after a quiet period. In contrast, maxspan (option B) sets a total time window from the first event, which would close the transaction regardless of activity after 2 minutes from the start. Options A and D (startswith/endswith) define specific start and end events rather than a timeout. Thus, maxpause ensures the transaction remains open as long as events arrive within 2 minutes of each other.
Variation 3. A company uses `transaction` to group events by `order_id`. Some orders have many events (1000+). Which option should be added to prevent a single transaction from consuming too many resources?
hard- A.keepevicted=true
- B.maxspan=1h
- ✓ C.maxevents=500
- D.maxpause=5m
Why C: Maxevents=500. This option limits the number of events that can be included in a single transaction, preventing a transaction with many events (like 1000+) from consuming too many resources. Option A (keepevicted=true) retains evicted events but does not limit resource usage. Option B (maxspan=1h) limits the time span of the transaction, not the event count. Option D (maxpause=5m) limits the time between events but does not cap the total number of events.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.