SPLK-1004 Macros And Workflow Actions — All Questions With Answers

A security analyst wants to create a search macro named `threat_lookup` that accepts an IP address and returns a boolean indicating whether the IP is on a known threat list. The macro should reference a lookup definition named `threat_intel_lookup`. The analyst defines the macro in `macros.conf` with the following stanza:

[threat_lookup]

definition = | lookup threat_intel_lookup ip AS src_ip OUTPUT threat_flag args = ip

When the analyst later runs `| makeresults | eval ip="10.0.0.1" | `threat_lookup(ip)` `, the search fails with an error. What is the most likely cause?

A Splunk user is creating a search macro that will be used to standardize the extraction of a user ID from an email address. The macro should take an email address as input and return the portion before the `@` symbol. The user writes the following definition in `macros.conf`:

[extract_user]

definition = eval user_id = replace($email$, "@.*", "") args = email

When the user runs a search that calls `extract_user("john.doe@example.com")`, the search returns an error. What is the most likely reason?