SPLK-1002 Transactions and Event Correlation Practice Question
Which THREE statements about the `transaction` command are true?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It can correlate events from different sourcetypes
Correct: A, C, D. A is true because the `transaction` command can correlate events from different sourcetypes into a single transaction. C is true because `transaction` sorts events within each transaction by `_time` to ensure chronological ordering. D is true because `transaction` can correlate events across multiple indexes. B is false because the `maxevents` option limits the maximum number of events per transaction, not the number of unique field values. E is false because `transaction` does not produce summary indexing output by default; it outputs events with a calculated duration field.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
It can correlate events from different sourcetypes
Why this is correct
Transaction groups events based on shared field values regardless of sourcetype.
- ✗
The maxevents option limits the number of unique field values per transaction
Why it's wrong here
maxevents limits number of events, not field values.
- ✓
It sorts events within each transaction by _time
Why this is correct
Transaction automatically orders events by _time ascending.
- ✓
It can correlate events across multiple indexes
Why this is correct
As long as fields match, transaction can group events from different indexes.
- ✗
Transaction always produces summary indexing output
Why it's wrong here
Transaction does not inherently produce summary output; it's a reporting command.
Go deeper
Related to this question
About these practice questions
This SPLK-1002 question is part of Courseiva's 475-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.