SPLK-1002 Macros, Saved Searches and CIM — 15 Questions

Question 1

An admin created a macro `myfilter(host)` with definition: `host=$host$ | stats count`. When calling `myfilter(webserver)`, the search returns no results. What is the most likely cause?

Accepted Answer

The macro argument is not being treated as a literal string.. The macro definition uses `host=$host$` without enclosing `$host$` in double quotes. When `myfilter(webserver)` is called, the expansion becomes `host=webserver | stats count`. Because the argument is not quoted, Splunk treats `webserver` as a raw literal string value for the `host` field—this should match events with `host=webserver`. However, the key point is that the macro argument should be quoted to guarantee it is treated as a literal string. In this scenario, the lack of quotes does not inherently cause the search to return no results unless the actual host values differ. The correct answer is B because the macro argument is not being treated as a literal string (i.e., it is not quoted), and this is the most likely cause of the issue when considering best practices. The reasoning is that if the argument contained special characters, it would break the search, and even for simple values, the macro expects quoted arguments to avoid misinterpretation.

Answer

The host field is case-sensitive.

Answer

The host field is not indexed.

Answer

The macro is evaluated before the rest of the search.

Question 2

What is the most likely cause of the error?

Accepted Answer

The macro name in the definition contains an invalid character (backtick).. The error is most likely due to the backtick character in the macro definition name. In Splunk, macro names must consist only of alphanumeric characters and underscores; backticks are invalid and cause a parsing error. Option A is incorrect because the stem does not indicate whether positional or named arguments are used; the error is about the macro name itself. Option C is incorrect because a missing parenthesis would cause a syntax error, but the backtick is a more specific issue. Option D repeats the confusion of option A; the error is not about argument syntax but about the name containing an invalid character.

Answer

The macro definition uses positional arguments but the call uses named arguments.

Answer

The macro call is missing a closing parenthesis.

Answer

The macro call uses named arguments instead of positional arguments.

Question 3

Which TWO of the following are valid considerations when defining macros in Splunk?

Accepted Answer

Macros can be imported from other apps if they are shared globally.. Correct answers: A and D. Macros must be defined with a unique name within an app (A), and macros can be imported from other apps if shared globally (D). Option B is false because macros can accept multiple arguments. Option C is false because macro definition is done in configuration files, not in the search bar. Option E is not a requirement; macros can contain any commands.

Answer

Macros cannot contain transforming commands.

Answer

Macros can only accept a single argument.

Answer

Macro definitions can be created directly in the search bar.

Question 4

An administrator configures a saved search that uses a macro to generate a summary index every hour. The macro includes a time range argument with default value `earliest=-1h@h latest=@h`. The saved search does not pass any time range argument, so the default is used. After a few days, the summary index is missing data for the last hour of each day. What is the most likely cause?

Accepted Answer

The macro definition used a static time range (e.g., `earliest=08:00:00 latest=09:00:00`) instead of a relative one.. If the macro definition uses a static time range (e.g., `earliest=08:00:00 latest=09:00:00`), it will always summarize data from that specific fixed hour regardless of when the search runs. Since the saved search runs every hour using the macro's default, it repeatedly summarizes the same hour (e.g., 08:00-09:00) and never covers the last hour of the day (e.g., 23:00-00:00). This causes missing data for the final hour of each day. Relative time ranges like `earliest=-1h@h` adjust to the current time and cover the most recent completed hour, avoiding such gaps.

Answer

The saved search schedule is set to run on the hour, but the macro's default time range covers the previous hour, creating an overlap.

Answer

The macro is defined in a private app, and the saved search runs in a different app, causing the macro default not to be used.

Answer

The saved search's summary index is configured with a summary range that is too short, causing old data to be aged out.

Question 5

Which THREE of the following are valid ways to define macro arguments in Splunk? (Select exactly 2.)

Accepted Answer

Defining arguments list in `args` field: `args = arg1, arg2`. In Splunk, macro arguments can be defined in several ways. Option C is correct: listing arguments in the `args` field (e.g., `args = arg1, arg2`) defines named arguments that can be referenced as `$arg1$`, `$arg2$`. Option D is correct: using `$arg$=default$` syntax defines a named argument with a default value. Option E is correct: using positional numeric arguments like `$1$`, `$2$` also defines macro arguments, referenced by position. Option A is incorrect because `$arg$` without a default value is not a valid definition; a default must be provided. Option B is incorrect because `eval` is not used to define arguments; arguments are defined in the macro definition itself.

Answer

`$arg$` without default

Answer

Using `| eval` to set argument values inside the macro

Question 6

An engineer wants to create a saved search that runs every hour and searches against 90 days of data. To optimize performance, they should...

Accepted Answer

Use a summary index to pre-compute results.. To optimize a saved search that runs every hour against 90 days of data, using a summary index is the best choice. Summary indexing pre-computes aggregated results and stores them in an index, which can be quickly retrieved each hour without re-scanning the full 90 days. Report acceleration (option D) also pre-computes results but is less efficient for such a large time range because it must maintain acceleration over 90 days. Option B (relative time range) is already implicit in the search. Option C (| stats with span) is a search technique and does not inherently optimize performance for repeated searches.

Answer

Set a time range relative to the search time.

Answer

Use the `| stats` command with `span` to aggregate.

Answer

Enable report acceleration on the saved search.

Question 7

Refer to the exhibit. An analyst executes the following search: `| filter_status(status_code=500)`. What will be the result?

Accepted Answer

The macro will fail because named arguments are not supported; Splunk macro arguments are positional.. The macro `filter_status` is defined with positional arguments (e.g., `$arg1$`), but the call `filter_status(status_code=500)` uses named argument syntax (`name=value`). Splunk macros only support named arguments if they are explicitly defined with `args = =` in the macro definition. Since this macro does not have such a definition, the named argument is not recognized, causing the macro to fail. The error occurs because Splunk cannot map `status_code=500` to the positional placeholder `$arg1$`.

Answer

The macro will run successfully, but it will use the literal string "status_code=500" as the argument value.

Answer

The macro will fail because the argument definition uses $arg1$ but the macro was called with "status_code=500".

Answer

The macro will run successfully, returning count of events with status=500.

Question 8

A security analyst wants to create a macro that extracts IP addresses from a field named `src_ip` and returns a count of unique IPs per source. Which macro definition accomplishes this?

Accepted Answer

| stats dc(src_ip) as unique_ips. `dc(src_ip)` is the Splunk command for distinct count, which returns the number of unique IP addresses in the `src_ip` field. This macro definition directly fulfills the requirement to count unique IPs per source, as `dc` is the standard abbreviation for distinct count in Splunk's `stats` command.

Answer

| stats count(src_ip) as unique_ips

Answer

| stats distinct_count(src_ip) as unique_ips

Answer

| stats unique(src_ip) as unique_ips

Question 9

A team regularly runs a saved search that joins two large indexes. Performance is poor. Which design change would MOST improve query performance?

Accepted Answer

Create a data model summary to pre-aggregate the data.. A data model summary pre-aggregates data at search time, reducing the volume of data that the join operation must process. This is the most effective way to improve performance when joining two large indexes, as it avoids scanning and joining raw events repeatedly.

Answer

Convert the saved search to a scheduled report.

Answer

Replace the join with a subsearch.

Answer

Use the `fields` command to remove unnecessary fields before the join.

Question 10

Which TWO of the following are valid uses of the Common Information Model (CIM) in Splunk?

Accepted Answer

Defining tags and event types to categorize data.. The CIM provides a standardized set of tags and event types that allow you to categorize and classify data from diverse sources, enabling consistent searching and correlation across your Splunk environment. Option E is correct because the CIM defines common field names (e.g., src_ip, dest_ip, user) to normalize data from different technologies, ensuring that searches and dashboards work uniformly regardless of the original data source.

Answer

Defining user roles and permissions for data access.

Answer

Managing license usage across indexers.

Answer

Creating new indexes for faster search performance.

Question 11

Which THREE of the following are best practices for creating saved searches?

Accepted Answer

Set an appropriate time range to limit the data scanned.. Setting an appropriate time range in a saved search limits the volume of data that Splunk must scan, reducing resource consumption and improving search performance. Without a bounded time range, the search may scan all available data, which can lead to excessive CPU and memory usage, especially in large deployments.

Answer

Save the search without scheduling it to avoid resource usage.

Answer

Avoid specifying a time range to use the default.

Question 12

Which TWO of the following are valid ways to reference a macro in a search?

Accepted Answer

`macro_name(arg1, arg2)`. In Splunk, a macro is invoked using backticks with parentheses around its arguments, as in `macro_name(arg1, arg2)`. This syntax tells the search processor to expand the macro definition with the provided arguments before executing the search.

Answer

$macro_name(arg1, arg2)$

Answer

macro_name:arg1, arg2

Answer

| macro_name(arg1, arg2)

Question 13

A Splunk administrator notices that a scheduled saved search `Daily Summary` fails every day at 2:00 AM with the error "Search job expired due to inactivity." The search runs against a large index and takes about 30 minutes to complete. What is the most likely cause?

Accepted Answer

The scheduled search is configured with a time limit shorter than 30 minutes.. The error 'Search job expired due to inactivity' indicates that the scheduled search was terminated before it could complete. In Splunk, saved searches have a configurable time limit (default 10 minutes) that specifies the maximum runtime before the search is killed. Since the search takes 30 minutes, the time limit must be set to less than 30 minutes, causing the premature termination.

Answer

The user who owns the saved search does not have permissions to run it at that time.

Answer

The indexer has reached its license quota and stops processing.

Answer

The search is consuming too much disk space.

Question 14

A security analyst wants to create a saved search that triggers an alert when more than 100 failed login attempts occur within a 5-minute window from the same source IP. The search should run every 5 minutes and alert only once per window. Which setting should be configured?

Accepted Answer

Enable 'Throttle' and set the throttle window to 5 minutes, throttling on the source IP field.. Enabling Throttle with a 5-minute window on the source IP field ensures that once an alert fires for a given source IP, subsequent alerts from that same IP are suppressed for the duration of the throttle window. This matches the requirement to alert only once per 5-minute window per source IP, preventing alert fatigue while still detecting the threshold breach.

Answer

Enable 'Digest mode' with a time window of 5 minutes.

Answer

Configure the search to use a 'Real-time' window of 5 minutes and set 'Alert on' to 'Result count'.

Answer

Set the 'Alert condition' to 'Number of results > 100' and use a rolling time window of 5 minutes.

Question 15

A Splunk admin wants to create a macro that extracts the username from a log line that always starts with 'User: <username>'. The macro should be reusable across searches. Which definition is correct?

Accepted Answer

`rex field=_raw "User: (?\S+)"`. The `rex` command with `field=_raw` and a named capturing group `(?\S+)` extracts the username into a field called `username`. This is the standard Splunk way to perform regex extraction in a search, and wrapping it in a macro makes it reusable across searches without additional syntax.

Answer

`eval username=extract("User: (?<username>\S+)")`

Answer

`rex field=_raw "User: (?<username>\S+)" | eval username=$result$`

Answer

`username = rex field=_raw "User: (?<username>\S+)"`