What does the keepevicted option do in the transaction command?

Forces all events to be included in a transaction regardless of time

Prevents events from being evicted from a transaction

Keeps events that were evicted from a transaction as separate events in the results

Deletes events that do not belong to any transaction

What is the effect of the following search: index=app | transaction user maxspan=10m?

Limits the number of events in each transaction to 10

Creates a transaction for each user that lasts exactly 10 minutes

Groups events with the same user value that occur within a 10-minute window

Groups all events that occur within 10 minutes regardless of user

What is a key difference between the transaction command and the stats command with values()?

transaction can only be used with time-based grouping, while stats can use any field

stats with values() preserves the original events, while transaction does not

transaction is faster than stats with values() for large datasets

transaction groups events into a single event, while stats with values() aggregates field values into a multivalue field

A system administrator is analyzing a server's boot process. The logs contain events with a common boot ID, and the administrator wants to group all events related to a single boot into a transaction. The boot process typically takes less than 2 minutes. Which transaction command configuration will achieve this?

... | transaction boot_id maxpause=2m

... | transaction host maxspan=2m

... | transaction boot_id maxspan=2m

... | transaction boot_id maxevents=2

SplunkCore Certified Power User

Domain 3Objective 1

Identify Transactions SPLK-1002 Practice Questions (Page 2)

Part of the Correlating Events domain, which accounts for 15% of the SPLK-1002 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~4–6 in this domain), expect 1–1 from this objective — we provide 10 practice questions to prepare you well beyond it. (estimate)

10questions here

2free pages

5concepts

15%of the exam

Questions 6–10

6foundation · easy
What does the keepevicted option do in the transaction command?
Select an answer first
7foundation · easy
What is the effect of the following search: index=app | transaction user maxspan=10m?
Select an answer first
8foundation · easy
Which transaction option limits the total duration of a transaction?
Select an answer first
9foundation · easy
What is a key difference between the transaction command and the stats command with values()?
Select an answer first
10application · medium
A system administrator is analyzing a server's boot process. The logs contain events with a common boot ID, and the administrator wants to group all events related to a single boot into a transaction. The boot process typically takes less than 2 minutes. Which transaction command configuration will achieve this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SPLK-1002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1002” is a trademark of its owner, used for identification only.

Identify Transactions SPLK-1002 Practice Questions (Page 2)

Questions 6–10

What does the keepevicted option do in the transaction command?

What is the effect of the following search: index=app | transaction user maxspan=10m?

Which transaction option limits the total duration of a transaction?

What is a key difference between the transaction command and the stats command with values()?

Keep studying — Correlating Events