Which Are Correct Statements About the transaction Command?
Which THREE statements about the `transaction` command are true?
Quick Answer
Several of the transaction command's behaviors are easy to mix up, so this question is really checking whether you can distinguish what each option actually controls. Grouping events by shared field values is the basic mechanism the command relies on, and because a transaction bundles multiple events together, fields that differ across those events naturally become multivalue fields in the resulting transaction event, preserving that information rather than discarding it. The maxpause option specifically limits the gap allowed between consecutive events, it does not cap the transaction's overall span; that's what a separate total-duration parameter is for, so treating maxpause as a total-time limit is a common but incorrect assumption. When startswith and endswith are used to explicitly define a transaction's opening and closing events, Splunk automatically adds a duration field to the resulting transaction, calculated from the first to the last event, giving you a ready-made measure of how long that logical transaction lasted. It's also worth remembering that transaction is inherently memory-intensive, since it has to hold all matching events in memory until a transaction's boundary closes, which is exactly why it's generally discouraged for very large datasets in favor of streaming alternatives like stats. When exam questions test transaction's mechanics, expect them to probe these exact distinctions: what triggers multivalue fields, what maxpause versus a total-span limit actually bounds, and when duration gets added automatically.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Transaction can correlate events based on more than one field.
The `transaction` command groups events based on one or more fields (option A true). It can include multivalue fields from constituent events (B true). The `maxpause` option sets the maximum pause between events, not the total time span; the `maxtime` option sets the maximum time span (so C false). When using `startswith` and `endswith`, a `duration` field is added (D true). Transaction is memory-intensive and not recommended for large datasets, making E false. Therefore, the correct options are A, B, and D.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Transaction can correlate events based on more than one field.
Why this is correct
Fields can be concatenated or multiple fields specified.
- ✓
Transaction events can contain multivalue fields from the constituent events.
Why this is correct
Fields from all events are merged.
- ✗
The maxpause option sets the maximum time span of the transaction.
Why it's wrong here
maxspan sets the maximum time span; maxpause sets the maximum gap between events.
- ✓
When using startswith and endswith, the transaction event includes a duration field.
Why this is correct
Duration is automatically calculated.
- ✗
Transaction is the most efficient way to group events from large datasets.
Why it's wrong here
Stats is often more memory-efficient.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1002 question from scratch — 475 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
6 more ways this is tested on SPLK-1002
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which three statements about the transaction command are correct? (Choose three.)
easy- ✓ A.The transaction command automatically adds an 'eventcount' field.
- B.The transaction command requires a startswith or endswith parameter.
- C.The transaction command can only correlate events within the same sourcetype.
- ✓ D.The transaction command automatically adds a 'duration' field.
- ✓ E.The transaction command can be used with events from different indexes.
Why A: Options A, D, and E are correct. The transaction command automatically adds the 'eventcount' and 'duration' fields to each result. It can also correlate events from different indexes, as it uses fields like ‘_time’ and a group-by field; there is no restriction that all events must come from the same index. Option B is false because startswith/endswith are optional; transaction can also use a field-based group (e.g., by session_id). Option C is false because transaction can correlate events from different sourcetypes.
Variation 2. Which TWO statements about the 'transaction' command are correct? (Choose two.)
medium- A.It requires all events to be from the same source.
- B.It sums numeric field values across events in the transaction.
- ✓ C.It can use the 'by' clause to group events based on common field values.
- D.The 'maxevents' option limits the total number of transactions output.
- ✓ E.It can combine multiple events into a single event.
Why C: The 'transaction' command can use a 'by' clause to group events that share common field values into a single transaction. This allows you to correlate events from different sources or sourcetypes as long as they have matching field values, enabling flexible event correlation.
Variation 3. Which TWO statements about the 'transaction' command are true? (Choose two.)
easy- A.The 'transaction' command cannot be used with the 'stats' command.
- B.The 'transaction' command only works on indexed fields.
- ✓ C.The 'transaction' command can include events from multiple sourcetypes.
- ✓ D.The 'transaction' command groups events based on common field values and time proximity.
- E.The 'transaction' command requires all events to be from the same host.
Why C: Options C and D are correct. The `transaction` command groups events based on common field values and time proximity, and it can include events from multiple sourcetypes. Option A is false because `transaction` can be used with `stats` (e.g., `... | transaction ... | stats count`). Option B is false because `transaction` works on any field, not just indexed fields. Option E is false because `transaction` does not require events to be from the same host; it can group events across different hosts if they share common field values.
Variation 4. Which THREE of the following are correct about the transaction command's default behavior?
medium- ✓ A.Transaction groups events by host, source, and sourcetype by default.
- ✓ B.Transaction does not require startswith or endswith to be specified.
- ✓ C.Transaction can evict partial transactions if maxpause is exceeded.
- D.Transaction requires all events to come from the same host.
- E.Transaction always includes all evicted events in the results.
Why A: Options A, B, and C are correct. By default, the transaction command groups events by host, source, and sourcetype (A). It does not require startswith or endswith to be specified; you can use fields or other options (B). Transactions can evict partial transactions if maxpause is exceeded, meaning if no new events arrive within the maxpause period, the transaction is considered complete and evicted (C). Option D is false because transaction does not require all events to come from the same host; by default it uses host, source, sourcetype but you can override with fields. Option E is false because evicted transactions are not included in the results unless you use the keepevicted=true option.
Variation 5. Which TWO statements are true about the `transaction` command in Splunk?
medium- ✓ A.It can group events based on one or more common field values.
- ✓ B.It automatically calculates the duration between the first and last event.
- C.It can only correlate events from the same sourcetype.
- ✓ D.It supports maxspan and maxpause options to control time boundaries.
- ✓ E.It automatically sorts events in chronological order within each transaction.
Why A: The `transaction` command groups events based on common field values (A) and supports options like maxspan and maxpause to define time boundaries (D). It also automatically adds a `duration` field calculated as the time difference between the first and last event in each transaction (B), and within each transaction, events are automatically sorted by _time in chronological order (E). Option C is false because transaction can correlate events across different sourcetypes if they share common fields.
Variation 6. Which THREE statements about the `transaction` command are true?
easy- ✓ A.It can correlate events from different sourcetypes
- B.The maxevents option limits the number of unique field values per transaction
- ✓ C.It sorts events within each transaction by _time
- ✓ D.It can correlate events across multiple indexes
- E.Transaction always produces summary indexing output
Why A: Correct: A, C, D. A is true because the `transaction` command can correlate events from different sourcetypes into a single transaction. C is true because `transaction` sorts events within each transaction by `_time` to ensure chronological ordering. D is true because `transaction` can correlate events across multiple indexes. B is false because the `maxevents` option limits the maximum number of events per transaction, not the number of unique field values. E is false because `transaction` does not produce summary indexing output by default; it outputs events with a calculated duration field.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.