Objective 3.4
Core Certified Power UserSearch with transactions
Objective 3.4 sits in Correlating Events, which carries 15% of the Core Certified Power User exam. The questions below are original, written from the official objective title above, and each explanation cites the Splunk page it rests on.
Objective title verbatim from the official objectives. Splunk exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
An analyst wants the first event of each transaction to be the one containing a given word. Which argument does Splunk document?
Correct.
Checked against help.splunk.com, August 2026Concept
Some transactions are marked by a message rather than by a clock. Naming the opening text is how you group by what the system said rather than by how long it waited.
Why C
Splunk's example defines the first event in the transaction as events that include a given string, using the startswith argument, and notes that endswith does the same for the last event.
Source
Splunk Docs: About transactions, checked August 2026The search defines the first event in the transaction as events that include the string, "view", using the startswith="view" argument. The endswith="purchase" argument does the same for the last event in the transaction.
Now you: objective 3.4 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 2
A user tries to filter on duration before the transaction command and it fails. Why does Splunk say the filter has to come after?
Sample question 2 of 2
An engineer calls a saved transaction type but also passes maxpause in the search. What does Splunk say wins?
Full Core Certified Power User question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.