SPLK-1002 Transactions and Event Correlation Practice Question
Which TWO of the following are limitations of the transaction command in Splunk?
⚠ Common exam trap
Many candidates assume the transaction command can only use indexed fields or cannot cross sourcetypes, but Splunk's transaction command is flexible with any search-time field and can correlate across multiple sourcetypes, making options B and D common distractors.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It defaults to a maximum of 1000 events per transaction.
The transaction command defaults to a maximum of 1000 events per transaction. If a transaction exceeds this limit, Splunk will close the transaction and start a new one, which can lead to incomplete or unexpected results. This limit can be increased using the maxevents argument, but it is a key constraint to be aware of when correlating large sequences of events.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It cannot be used inside an eval statement.
Why it's wrong here
Transaction is a generating command, not used in eval, but it can be used in a subsearch.
- ✗
It only works with indexed fields.
Why it's wrong here
It can use extracted and calculated fields.
- ✓
It defaults to a maximum of 1000 events per transaction.
Why this is correct
The default maxevents is 1000.
- ✗
It cannot correlate events from multiple sourcetypes.
Why it's wrong here
Transaction can correlate across sourcetypes if they share the same field.
- ✓
It can consume significant memory and processing resources.
Why this is correct
Transaction is memory-intensive because it holds events until the transaction closes.
Go deeper
Related to this question
About these practice questions
This SPLK-1002 question is part of Courseiva's 475-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.