Correlating Events for Splunk Core Certified Power User

Sample Practice Questions

1. Question 1

   Which of the following statements would help a user choose between the transaction and stats commands?
   1. A. stats can only group events using IP addresses.
   2. B. The transaction command is faster and more efficient.
   3. C. There is a 1000 event limitation with the transaction command.
   4. D. Use stats when the events need to be viewed as a single correlated event.
   Explanation

   The correct answer is: C. There is a 1000 event limitation with the transaction command..

   The practical constraint that guides the choice is that transaction caps each group at 1000 events, so a session or workflow producing more than that will be truncated and the resulting composite event will be incomplete. Knowing that limit tells you when transaction stops being viable and stats becomes necessary. The claim that transaction is faster and more efficient is backwards, since transaction must hold candidate groups in memory while it decides whether they are complete, making it the more expensive of the two. stats is not limited to grouping by IP addresses, because its by clause accepts any field or combination of fields. And viewing events as a single correlated event is what transaction produces rather than stats, so that option assigns the behavior to the wrong command, since stats returns aggregate rows and discards the underlying events.

2. Question 2

   What do events in a transaction have in common?
   1. A. All events in a transaction must have the same timestamp.
   2. B. All events in a transaction must have the same sourcetype.
   3. C. All events in a transaction must have the exact same set of fields.
   4. D. All events in a transaction must be related by one or more fields.
   Explanation

   The correct answer is: D. All events in a transaction must be related by one or more fields..

   Events in a transaction are related by one or more fields, which is the entire basis on which the command groups them: you name the fields, and events sharing the same values in those fields become candidates for the same group. Everything else about the events can differ. They need not share a timestamp, and normally must not, since a transaction represents activity unfolding over time and the command computes a duration from the spread between its earliest and latest member. They need not share a sourcetype, which is what makes transaction useful for correlating a web log with an application log around a common session identifier. And they need not carry the same set of fields, because the composite event simply accumulates whatever fields its members contribute.

3. Question 3

   When should transaction be used?
   1. A. Only in a large distributed Splunk environment.
   2. B. When calculating results from one or more fields.
   3. C. When event grouping is based on start/end values.
   4. D. When grouping events results in over 1000 events in each group.
   Explanation

   The correct answer is: C. When event grouping is based on start/end values..

   transaction is the right choice when grouping depends on start and end values, because it accepts startswith and endswith arguments that define the boundaries of a group from the content of the events themselves. That capability is unique to it, since stats can group by shared field values but has no notion of where a sequence begins or ends. Calculating results from one or more fields is what stats and eval do, so reaching for transaction to perform a calculation would be the wrong instrument. Nothing about transaction requires a large distributed environment, and if anything its memory cost makes it less comfortable at scale. And exceeding 1000 events per group is a reason to avoid transaction rather than to choose it, because that is the per-group limit at which groups are truncated.

4. Question 4

   Which of the following statements describe the command below? (Choose all that apply.) sourcetype=access_combined | transaction JSESSIONID
   1. A. An additional field named maxspan is created.
   2. B. An additional field named duration is created.
   3. C. An additional field named eventcount is created.
   4. D. Events with the same JSESSIONID will be grouped together into a single event.
   Explanation

   The correct answers are: B. An additional field named duration is created., C. An additional field named eventcount is created., D. Events with the same JSESSIONID will be grouped together into a single event..

   Running transaction against a session identifier groups every event sharing the same value into one composite event, which is the command's core behavior and the reason it is used for session reconstruction. Two fields are added automatically to each group. duration records the elapsed time between the earliest and latest member events, which is what makes a transaction useful for measuring how long an activity took. eventcount records how many events were combined, which is how you spot groups that hit the 1000-event truncation limit. No field named maxspan is created, and that is the distinction being tested: maxspan is an argument you supply to constrain how wide a group may be in time, not a field the command outputs. Since it is not supplied here, no span constraint applies at all.

5. Question 5

   When using the transaction command, what does the argument maxspan do?
   1. A. Sets the maximum total time between events in a transaction.
   2. B. Sets the maximum length of all the events within a transaction.
   3. C. Sets the maximum total time between the earliest and latest events in a transaction.
   4. D. Sets the maximum length that any single event can reach to be included in the transaction.
   Explanation

   The correct answer is: C. Sets the maximum total time between the earliest and latest events in a transaction..

   maxspan sets the maximum total time from the earliest event in a transaction to the latest, so it bounds the overall width of the group rather than the interval between any two members. A group whose events span longer than the limit is not formed, which is how you prevent unrelated activity from being swept into one session. The gap between consecutive events is governed by a different argument, maxpause, and confusing the two is the most common error here, since maxspan is the whole window while maxpause is the pause between neighbours. Neither argument concerns the length of an event's text, so the two options referring to how long events are describe something the command does not measure. Both accept a value with a unit such as 30s or 5m, and they can be combined to constrain a group in both dimensions at once.

Other Splunk Core Certified Power User domains

• Creating and Managing Fields (21 questions)
• Creating and Using Macros (20 questions)
• Creating and Using Workflow Actions (25 questions)
• Creating Data Models (27 questions)
• Creating Field Aliases and Calculated Fields (22 questions)
• Creating Tags and Event Types (21 questions)
• Filtering and Formatting Results (27 questions)
• Using the Common Information Model (CIM) (17 questions)
• Using Transforming Commands for Visualizations (19 questions)