In the transaction command, what does the startswith option specify?

The field that is used to group events together

The maximum time span allowed between the first and last event

The maximum number of events that can be included in a transaction

The condition that identifies the first event in a transaction

Which scenario is best suited for using the transaction command?

Renaming a field from 'user' to 'username' in the search results

Filtering out events that contain the word 'ERROR' from the search results

Correlating a login event, subsequent file access events, and a logout event for a single user session

Calculating the average response time of a web server over the last hour

Which search would group events into transactions based on a common session ID?

index=web | stats values(session_id)

index=web | transaction session_id

What is the primary purpose of the transaction command in Splunk?

To convert raw event text into structured key-value pairs

To calculate statistical summaries such as average, count, and sum for numeric fields

To remove duplicate events that have identical field values

To group related events into a single event based on shared fields or time proximity

When would you prefer using stats with values() over transaction?

When you only need to see the distinct values of a field for each group, without combining the raw events

When you need to calculate the total duration of a user session

When you need to see all the raw events that belong to a single user session

When you need to group events that have a common start and end condition

SplunkCore Certified Power User

Domain 3Objective 1

Identify Transactions SPLK-1002 Practice Questions (Page 1)

Part of the Correlating Events domain, which accounts for 15% of the SPLK-1002 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~4–6 in this domain), expect 1–1 from this objective — we provide 10 practice questions to prepare you well beyond it. (estimate)

10questions here

2free pages

5concepts

15%of the exam

Questions 1–5

1foundation · easy
In the transaction command, what does the startswith option specify?
Select an answer first
2foundation · easy
Which scenario is best suited for using the transaction command?
Select an answer first
3foundation · easy
Which search would group events into transactions based on a common session ID?
Select an answer first
4foundation · easy
What is the primary purpose of the transaction command in Splunk?
Select an answer first
5foundation · easy
When would you prefer using stats with values() over transaction?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1002” is a trademark of its owner, used for identification only.