A Splunk admin is troubleshooting a slow search that uses the transaction command to group events by a session_id field. The search times out frequently. The admin notices that some sessions span several hours, and the dataset is very large. The admin needs to improve performance while still being able to analyze the full session flow. Which approach should the admin take?

Increase the search timeout setting in Splunk.

Use the transaction command with a larger maxevents option.

Replace transaction with stats to aggregate the session data.

Add a maxspan option to the transaction command to limit the time window.

A logistics company wants to track the total weight and the number of packages shipped per destination. The events have fields: destination, weight, and package_id. The team needs a summary report. Which command should be used?

transaction package_id, then use eventstats to calculate totals

stats values(weight) AS total_weight, count(package_id) AS num_packages by destination

transaction destination, then use stats to calculate totals

stats sum(weight) AS total_weight, count(package_id) AS num_packages by destination

Which task is best accomplished using the stats command?

Counting the number of events per status code from web server logs

Removing duplicate events that have the same source IP address

Combining login and logout events into a single session transaction

Extracting a username from a raw log message using a regular expression

Which of the following is a valid use of the stats command?

stats avg(response_time) BY endpoint

stats session_id startswith="login"

What is the primary purpose of the transaction command in Splunk?

To calculate statistical aggregations such as average, sum, and count across events

To extract new fields from raw event text using regular expressions

To group related events into a single transaction based on common fields or session identifiers

To remove duplicate events from the search results based on a specified field

SplunkCore Certified Power User

Domain 3Objective 6

Determine When to Use Transactions vs. Stats SPLK-1002 Practice Questions (Page 2)

Part of the Correlating Events domain, which accounts for 15% of the SPLK-1002 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~4–6 in this domain), expect 1–1 from this objective — we provide 17 practice questions to prepare you well beyond it. (estimate)

17questions here

4free pages

7concepts

15%of the exam

Questions 6–10

6expert · hard
A Splunk admin is troubleshooting a slow search that uses the transaction command to group events by a session_id field. The search times out frequently. The admin notices that some sessions span several hours, and the dataset is very large. The admin needs to improve performance while still being able to analyze the full session flow. Which approach should the admin take?
Select an answer first
7application · medium
A logistics company wants to track the total weight and the number of packages shipped per destination. The events have fields: destination, weight, and package_id. The team needs a summary report. Which command should be used?
Select an answer first
8foundation · easy
Which task is best accomplished using the stats command?
Select an answer first
9foundation · easy
Which of the following is a valid use of the stats command?
Select an answer first
10foundation · easy
What is the primary purpose of the transaction command in Splunk?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1002” is a trademark of its owner, used for identification only.