A web team wants to group all events for a single user session, but only if the events occur within 20 minutes of each other. The events have a field 'session_id'. Which search should they use?

index=web | stats count by session_id

index=web | transaction maxspan=20m

index=web | transaction session_id maxspan=20m

index=web | bucket session_id span=20m

A DevOps engineer wants to group all events for each deployment ID into a single event, but only if the events occur within 15 minutes of each other. The events have a field 'deployment_id'. Which search should they use?

index=deploy | transaction deployment_id maxspan=15m

index=deploy | transaction maxspan=15m

index=deploy | stats count by deployment_id

index=deploy | bucket deployment_id span=15m

Which command can group events into transactions using both a common field value and a maximum time span?

transaction session_id maxspan=30m

A support analyst wants to group all events for each customer ID into a single event, but only if the events occur within 45 minutes of each other. The events have a field 'customer_id'. Which search should they use?

index=support | stats count by customer_id

index=support | transaction maxspan=45m

index=support | bucket customer_id span=45m

index=support | transaction customer_id maxspan=45m

SplunkCore Certified Power User

Domain 3Objective 3

Group Events Using Fields and Time SPLK-1002 Practice Questions (Page 1)

Part of the Correlating Events domain, which accounts for 15% of the SPLK-1002 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~4–6 in this domain), expect 1–1 from this objective — we provide 17 practice questions to prepare you well beyond it. (estimate)

17questions here

4free pages

3concepts

15%of the exam

Questions 1–5

1application · medium
A web team wants to group all events for a single user session, but only if the events occur within 20 minutes of each other. The events have a field 'session_id'. Which search should they use?
Select an answer first
2foundation · easy
Which command would you use to group all events with the same order_id into a single transaction?
Select an answer first
3application · medium
A DevOps engineer wants to group all events for each deployment ID into a single event, but only if the events occur within 15 minutes of each other. The events have a field 'deployment_id'. Which search should they use?
Select an answer first
4foundation · easy
Which command can group events into transactions using both a common field value and a maximum time span?
Select an answer first
5application · medium
A support analyst wants to group all events for each customer ID into a single event, but only if the events occur within 45 minutes of each other. The events have a field 'customer_id'. Which search should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1002” is a trademark of its owner, used for identification only.