A data engineer needs to correlate events by a `request_id` field and also needs to calculate the total time between the first and last event for each request. The dataset is very large, and performance is a concern. Which approach is most appropriate?

Use `transaction request_id` and rely on the duration field.

Use `stats earliest(_time) as start, latest(_time) as end by request_id` and calculate the difference.

Use `transaction request_id maxspan=1h` to limit the time span.

Use `stats values(_time) by request_id`.

A security analyst needs to correlate all authentication events for a single user session. The logs contain a session ID field, and each event has a timestamp. The analyst wants to group events that share the same session ID and occurred within 30 minutes of each other. Which transaction command should be used?

transaction startswith="login" endswith="logout"

transaction session_id maxspan=30m

stats values(session_id) by _time

Why can the transaction command be resource-intensive on large datasets?

Because it requires a large amount of disk space to store the transaction results

Because it sends all events to a single search head for processing

Because it creates a new index for each transaction

Because it requires sorting all events by time and grouping them, which can consume significant memory and CPU

SplunkCore Certified Power User

Domain 3Objective 5

Report on Transactions SPLK-1002 Practice Questions (Page 3)

Part of the Correlating Events domain, which accounts for 15% of the SPLK-1002 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~4–6 in this domain), expect 1–1 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

6concepts

15%of the exam

Questions 11–15

11foundation · easy
Which of the following fields is automatically generated by the transaction command?
Select an answer first
12application · medium
A data engineer needs to correlate events by a `request_id` field and also needs to calculate the total time between the first and last event for each request. The dataset is very large, and performance is a concern. Which approach is most appropriate?
Select an answer first
13application · medium
A security analyst needs to correlate all authentication events for a single user session. The logs contain a session ID field, and each event has a timestamp. The analyst wants to group events that share the same session ID and occurred within 30 minutes of each other. Which transaction command should be used?
Select an answer first
14foundation · easy
Why can the transaction command be resource-intensive on large datasets?
Select an answer first
15foundation · easy
Which transaction option is used to limit the total time span of a transaction?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1002” is a trademark of its owner, used for identification only.

Report on Transactions SPLK-1002 Practice Questions (Page 3)

Questions 11–15

Which of the following fields is automatically generated by the transaction command?

A data engineer needs to correlate events by a `request_id` field and also needs to calculate the total time between the first and last event for each request. The dataset is very large, and performance is a concern. Which approach is most appropriate?

Why can the transaction command be resource-intensive on large datasets?

Which transaction option is used to limit the total time span of a transaction?

Keep studying — Correlating Events