SPLK-1002 Transactions and Event Correlation Practice Question
Which TWO statements correctly describe the behavior of the transaction command in Splunk?
⚠ Common exam trap
Many candidates confuse the transaction command's field merging behavior (which creates multivalue fields) with the `stats values()` function, or assume duration is automatically calculated without the `duration` option, leading them to select option B or D incorrectly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It can concatenate the raw text of all events in the transaction into a single event.
The transaction command can be configured with the `mvraw` option to concatenate the raw text of all events in the transaction into a single event. This is useful when you need to preserve the full log lines of a correlated sequence, such as a multi-step user session or a series of API calls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It is not recommended for use with large datasets because it consumes too much memory.
Why it's wrong here
While transaction can be memory-intensive, it is commonly used with large datasets when configured properly.
- ✗
It merges all fields from all events into a single event, with the last event's field value taking precedence.
Why it's wrong here
Fields are not merged; they remain associated with each event within the transaction.
- ✓
It can concatenate the raw text of all events in the transaction into a single event.
Why this is correct
The transaction command can combine raw event text from all related events into one event.
- ✗
It automatically calculates the duration of each transaction as the difference between the first and last event timestamps.
Why it's wrong here
Duration is not automatically calculated; you must use eval or convert to compute it.
- ✓
It can close a transaction based on a change in a specific field value or after a specified timeout.
Why this is correct
The endswith or maxspan/maxpause options control transaction closure.
Go deeper
Related to this question
About these practice questions
This SPLK-1002 question is part of Courseiva's 475-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.