Which search would group events into transactions that share the same user_id and occur within 10 minutes of each other?

transaction user_id maxspan=10m

An administrator needs to count how many web requests occurred in 5-minute intervals over the past hour. The events have a field 'status' but the administrator only cares about the time distribution. Which search correctly groups the events into 5-minute buckets?

index=web | bucket _time span=5m | stats count by _time

index=web | timechart count by status

index=web | bucket status span=5m | stats count by status

index=web | transaction maxspan=5m

A network engineer wants to see all events for each source IP address as a single event, but only for events that occur within a 10-minute window. The events have a field 'src_ip'. Which search should they use?

index=network | stats count by src_ip

index=network | transaction src_ip maxspan=10m

index=network | transaction maxspan=10m

index=network | bucket src_ip span=10m

SplunkCore Certified Power User

Domain 3Objective 3

Group Events Using Fields and Time SPLK-1002 Practice Questions (Page 3)

Part of the Correlating Events domain, which accounts for 15% of the SPLK-1002 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~4–6 in this domain), expect 1–1 from this objective — we provide 17 practice questions to prepare you well beyond it. (estimate)

17questions here

4free pages

3concepts

15%of the exam

Questions 11–15

11foundation · easy
Which search would group events into transactions that share the same user_id and occur within 10 minutes of each other?
Select an answer first
12foundation · easy
Which Splunk search command groups events into transactions based on shared field values?
Select an answer first
13application · medium
An administrator needs to count how many web requests occurred in 5-minute intervals over the past hour. The events have a field 'status' but the administrator only cares about the time distribution. Which search correctly groups the events into 5-minute buckets?
Select an answer first
14foundation · easy
Which Splunk command groups events into time-based buckets?
Select an answer first
15application · medium
A network engineer wants to see all events for each source IP address as a single event, but only for events that occur within a 10-minute window. The events have a field 'src_ip'. Which search should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1002” is a trademark of its owner, used for identification only.

Group Events Using Fields and Time SPLK-1002 Practice Questions (Page 3)

Questions 11–15

Which search would group events into transactions that share the same user_id and occur within 10 minutes of each other?

Which Splunk search command groups events into transactions based on shared field values?

An administrator needs to count how many web requests occurred in 5-minute intervals over the past hour. The events have a field 'status' but the administrator only cares about the time distribution. Which search correctly groups the events into 5-minute buckets?

Which Splunk command groups events into time-based buckets?

A network engineer wants to see all events for each source IP address as a single event, but only for events that occur within a 10-minute window. The events have a field 'src_ip'. Which search should they use?

Keep studying — Correlating Events