SPLK-1002 › Macros, Saved Searches and CIM
This domain covers Splunk knowledge objects that make searches reusable and operational: macros, saved searches, alerts, scheduled reports, and the Common Information Model. Questions test cron scheduling syntax, macro arguments, alert action configuration, and CIM field names for normalized data models. Expect scenario-based items requiring you to pick the correct setting, expression, or field rather than recall definitions alone.
SPLK-1002 Macros, Saved Searches and CIM — All 142 Questions
Every question in this domain with answers and detailed explanations.