Objective 3.1
Core Certified Power UserIdentify transactions
Objective 3.1 sits in Correlating Events, which carries 15% of the Core Certified Power User exam. The questions below are original, written from the official objective title above, and each explanation cites the Splunk page it rests on.
Objective title verbatim from the official objectives. Splunk exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
One customer booking a hotel room produces a search, a selection and a payment event minutes apart, and you want them handled as one unit. What is a transaction?
Correct.
Checked against help.splunk.com, August 2026Concept
A single real world action rarely produces a single log line. Treating the scattered lines as one object is what lets you ask how long the action took or whether it finished.
Why C
Splunk defines a transaction as any group of conceptually related events that spans time, giving a hotel reservation by one customer and a set of events from a firewall intrusion incident as examples.
Source
Splunk Docs: About transactions, checked August 2026A transaction is any group of conceptually-related events that spans time, such as a series of events related to the online reservation of a hotel room by a single customer, or a set of events related to a firewall intrusion incident.
Now you: objective 3.1 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
You define a grouping once in transactiontypes.conf so every analyst can call it by name from the transaction command. What is a transaction type?
Sample question 2 of 3
A login attempt on one web server and the resulting proxy denial on another must land in the same group. Which combinations of events can a transaction include?
Sample question 3 of 3
Your transaction groups six events, and the result you get back still shows every original line rather than a summary. What makes up the raw text of a transaction?
Full Core Certified Power User question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.