Report on Transactions SPLK-1002 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of the transaction command in Splunk?

   • ATo filter events based on a search string and return only matching events
   • BTo sort events by timestamp in ascending order
   • CTo calculate statistical aggregations such as average and count across multiple events
   • DTo group related events into a single event based on a common field or time proximity
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What does the keepevicted option do in the transaction command?

   • AIt keeps events that were evicted from a transaction as separate events in the results
   • BIt prevents events from being evicted from a transaction
   • CIt deletes evicted events from the index
   • DIt forces all events to be included in a transaction regardless of criteria
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An analyst is using the transaction command and wants to see the number of events in each transaction. They also want to filter out transactions that have fewer than 3 events. Which approach should they take?

   • AAdd `count` to the transaction command and then use `where count >= 3`.
   • BUse `transaction maxevents=3`.
   • CAdd `eventcount` to the transaction command and then use `where eventcount >= 3`.
   • DUse `stats count by _time` and filter with `where count >= 3`.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   After running a transaction command, an analyst wants to see the start time of each transaction. Which field should they use?

   • Astarttime
   • Bfirstevent
   • C_time
   • Dbegin
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security analyst is investigating a potential breach. They need to group all events related to a specific user session, but the session may have gaps of up to 10 minutes between events. They also want to see the total number of events in each session and the duration. Which transaction command should they use?

   • Atransaction session_id maxspan=10m
   • Btransaction session_id maxpause=10m
   • Ctransaction session_id maxevents=10
   • Dtransaction session_id keepevicted=true
   Reveal Solution Discussion Select an answer first