SPLK-1002 Transactions and Event Correlation Practice Question
Which two techniques should be used to optimize a transaction search that is slow due to a high volume of events? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the 'fields' command to limit fields before transaction.
Options A and C are correct. Using the 'fields' command before 'transaction' limits the data to only relevant fields, reducing memory and processing overhead. Option C is correct because the 'stats' command with functions like values() and range() can often replace 'transaction' for event correlation, avoiding the resource-intensive transaction command. Option B is incorrect because 'keepevicted' is used to retain evicted transactions but does not free memory or optimize performance. Option D is incorrect because using the 'local' parameter restricts processing to a single indexer, which can actually harm performance by eliminating parallelism. Option E is incorrect because increasing 'maxspan' expands the time window, potentially increasing the number of events per transaction and worsening performance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use the 'fields' command to limit fields before transaction.
Why this is correct
Correct: reduces memory per event.
- ✗
Use the 'keepevicted' option to free memory.
Why it's wrong here
Incorrect: keepevicted retains evicted transactions, using more memory.
- ✓
Use the 'stats' command with values() and range() instead of transaction if possible.
Why this is correct
Correct: stats can be more efficient than transaction for certain aggregations.
- ✗
Use the 'local' parameter to process on a single indexer.
Why it's wrong here
Incorrect: local reduces parallelism and may slow the search.
- ✗
Increase the maxspan value to reduce the number of transactions.
Why it's wrong here
Incorrect: larger maxspan increases memory and processing.
Go deeper
Related to this question
About these practice questions
One of 475 original SPLK-1002 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SPLK-1002
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. The search returns no transactions even though there are login and logout events in the index. What is the most likely cause?
easy- A.The maxpause value is too short.
- B.The startswith and endswith options are mispelled.
- C.The sourcetype is incorrect.
- ✓ D.The transaction command may be timing out due to large data volume.
Why D: When the transaction command processes a large volume of data, it may exceed the default memory or time limits, causing the search to complete without returning any results. This is a common issue with transaction, especially when there are many events to correlate. Option A is incorrect because the maxpause value is not specified in the exhibit; if it were too short, events close together might be missed, but no transactions at all suggests a different problem. Option B is incorrect because any misspelling in startswith or endswith would typically prevent the search from running or cause syntax errors. Option C is incorrect because the sourcetype appears to be present in the events; the issue is not about missing sourcetype.
Variation 2. Which THREE strategies can help reduce memory usage when using the transaction command? (Select exactly 3 correct answers.)
medium- ✓ A.Filter events before the transaction command.
- ✓ B.Reduce maxspan and maxpause.
- ✓ C.Use fields to limit fields before transaction.
- D.Use keepevicted=true.
- E.Increase maxopentxn.
Why A: Reducing maxspan and maxpause limits the time window, thus fewer open transactions. Filtering events early and using the fields command to limit fields reduce data volume. Increasing maxopentxn and keepevicted=true increase memory usage.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.