SPLK-1002 Macros, Saved Searches and CIM — 50 Questions

Question 1

A security analyst wants to create a macro that extracts IP addresses from a field named `src_ip` and returns a count of unique IPs per source. Which macro definition accomplishes this?

Accepted Answer

| stats dc(src_ip) as unique_ips. `dc(src_ip)` is the Splunk command for distinct count, which returns the number of unique IP addresses in the `src_ip` field. This macro definition directly fulfills the requirement to count unique IPs per source, as `dc` is the standard abbreviation for distinct count in Splunk's `stats` command.

Answer

| stats count(src_ip) as unique_ips

Answer

| stats distinct_count(src_ip) as unique_ips

Answer

| stats unique(src_ip) as unique_ips

Question 2

A team regularly runs a saved search that joins two large indexes. Performance is poor. Which design change would MOST improve query performance?

Accepted Answer

Create a data model summary to pre-aggregate the data.. A data model summary pre-aggregates data at search time, reducing the volume of data that the join operation must process. This is the most effective way to improve performance when joining two large indexes, as it avoids scanning and joining raw events repeatedly.

Answer

Convert the saved search to a scheduled report.

Answer

Replace the join with a subsearch.

Answer

Use the `fields` command to remove unnecessary fields before the join.

Question 3

An admin created a macro `myfilter(host)` with definition: `host=$host$ | stats count`. When calling `myfilter(webserver)`, the search returns no results. What is the most likely cause?

Accepted Answer

The macro argument is not being treated as a literal string.. The macro definition uses `host=$host$` without enclosing `$host$` in double quotes. When `myfilter(webserver)` is called, the expansion becomes `host=webserver | stats count`. Because the argument is not quoted, Splunk treats `webserver` as a raw literal string value for the `host` field—this should match events with `host=webserver`. However, the key point is that the macro argument should be quoted to guarantee it is treated as a literal string. In this scenario, the lack of quotes does not inherently cause the search to return no results unless the actual host values differ. The correct answer is B because the macro argument is not being treated as a literal string (i.e., it is not quoted), and this is the most likely cause of the issue when considering best practices. The reasoning is that if the argument contained special characters, it would break the search, and even for simple values, the macro expects quoted arguments to avoid misinterpretation.

Answer

The host field is case-sensitive.

Answer

The host field is not indexed.

Answer

The macro is evaluated before the rest of the search.

Question 4

Which TWO of the following are valid ways to reference a macro in a search?

Accepted Answer

`macro_name(arg1, arg2)`. In Splunk search processing language, a macro can be referenced in two valid ways: by wrapping the macro name and its arguments in backticks, as in option C `macro_name(arg1, arg2)`, or by using the backtick-delimited form with space-separated arguments, as in option D `macro_name arg1 arg2`. Both forms are recognized by the search parser as macro invocations, with the parenthetical form being the standard for macros that accept arguments and the space-separated form being valid when the macro definition expects positional arguments. Option A is incorrect because the dollar-sign syntax ($macro_name(arg1, arg2)$) is used for token or field references in dashboards and alerts, not for invoking macros in a search. Option B is incorrect because the colon syntax (macro_name:arg1, arg2) is not a valid macro invocation format in Splunk. Option E is incorrect because prefixing the macro with a pipe (| macro_name(arg1, arg2)) treats it as a search command rather than a macro reference, which is not how macros are invoked.

Answer

$macro_name(arg1, arg2)$

Answer

macro_name:arg1, arg2

Answer

| macro_name(arg1, arg2)

Question 5

A security analyst wants to create a saved search that triggers an alert when more than 100 failed login attempts occur within a 5-minute window from the same source IP. The search should run every 5 minutes and alert only once per window. Which setting should be configured?

Accepted Answer

Enable 'Throttle' and set the throttle window to 5 minutes, throttling on the source IP field.. Enabling Throttle with a 5-minute window on the source IP field ensures that once an alert fires for a given source IP, subsequent alerts from that same IP are suppressed for the duration of the throttle window. This matches the requirement to alert only once per 5-minute window per source IP, preventing alert fatigue while still detecting the threshold breach.

Answer

Enable 'Digest mode' with a time window of 5 minutes.

Answer

Configure the search to use a 'Real-time' window of 5 minutes and set 'Alert on' to 'Result count'.

Answer

Set the 'Alert condition' to 'Number of results > 100' and use a rolling time window of 5 minutes.

Question 6

A Splunk admin wants to create a macro that extracts the username from a log line that always starts with 'User: <username>'. The macro should be reusable across searches. Which definition is correct?

Accepted Answer

`rex field=_raw "User: (?\S+)"`. The `rex` command with `field=_raw` and a named capturing group `(?\S+)` extracts the username into a field called `username`. This is the standard Splunk way to perform regex extraction in a search, and wrapping it in a macro makes it reusable across searches without additional syntax.

Answer

`eval username=extract("User: (?<username>\S+)")`

Answer

`rex field=_raw "User: (?<username>\S+)" | eval username=$result$`

Answer

`username = rex field=_raw "User: (?<username>\S+)"`

Question 7

An organization uses Splunk CIM to normalize data from multiple sources. They have a custom data source that logs firewall events with a field 'action' containing values 'accept', 'deny', 'drop'. They want to map this to the CIM field 'action'. Which configuration is required?

Accepted Answer

Define a field alias in props.conf: `FIELDALIAS-action = action as action`. The CIM field 'action' already exists in the CIM data model with the same name as the vendor field. A field alias in props.conf using `FIELDALIAS-action = action as action` simply creates an alias so that the vendor's 'action' field is recognized as the CIM 'action' field, allowing the CIM to normalize the data without any transformation. This is the simplest and most efficient method when the vendor field name and values already match the CIM field name and expected values.

Answer

Use the 'calculatedfields' field in props.conf: `CALCULATED_action = if(action=="accept","allowed",if(action=="deny","blocked","dropped"))`

Answer

Create a custom data model that includes the field 'action' with the vendor values.

Answer

Add a tag 'action=accept' to events with action=accept, and similarly for deny and drop.

Question 8

A Splunk admin notices that a saved search scheduled to run every 10 minutes is consistently taking 15 minutes to complete, causing overlapping runs. The search aggregates data across multiple indexes and uses a large time window. What is the best way to prevent overlap and ensure the search completes?

Accepted Answer

Configure the search to 'Skip the next scheduled run if the previous run is still in progress'.. The 'Skip the next scheduled run if the previous run is still in progress' setting is specifically designed to prevent overlapping executions of a saved search. This ensures that if a search takes longer than its scheduled interval, the next scheduled run is skipped, avoiding resource contention and incomplete results.

Answer

Set the search to 'Run on a timer' and increase the schedule interval to 20 minutes.

Answer

Enable the 'Schedule Priority' setting to 'Higher' and set 'Schedule Window' to 0.

Answer

Reduce the search time window to 5 minutes to decrease execution time.

Question 9

Which THREE of the following are components of the Splunk Common Information Model (CIM)? (choose three)

Accepted Answer

Endpoint. The Splunk Common Information Model (CIM) defines a set of data models that normalize event data across sources, and among its core models are Endpoint (B), Authentication (C), and Network Traffic (E). The Endpoint data model normalizes endpoint-related events such as process execution, file system changes, registry activity, and service status, which is why option B is correct. The Authentication data model normalizes authentication events including successful and failed logons, account creation, and privilege changes, making option C correct. The Network Traffic data model normalizes network flow and connection data such as bytes transferred, source/destination IPs, and ports, so option E is correct. Application State (A) and Change Analysis (D) are not CIM data models; Application State is not a defined CIM model, and Change Analysis is a Splunk Enterprise Security framework concept rather than a CIM component.

Answer

Application State

Answer

Change Analysis

Question 10

A user wants to create a macro that calculates the average response time for web requests. The macro should accept a field name as an argument and return the average. Which syntax is correct for defining the macro?

Accepted Answer

`stats avg($field$) as avg_response`. In Splunk macro definitions, the argument placeholder syntax is `$field$` (with dollar signs), and the macro body must be a valid search string. The `stats avg($field$) as avg_response` correctly uses the argument in a stats command and assigns a static alias, which is the standard way to return a single computed value from a macro. Option C is wrong because although it uses valid syntax with `$field$`, it creates a dynamic alias (`avg_$field$`) which is not appropriate for a macro that needs to return a fixed field name for the average. The requirement is to return the average, so a static alias like `avg_response` is correct.

Answer

`stats avg($field$) | eval avg_response=$result$`

Answer

"stats avg($field$) as avg_response"

Answer

`stats avg($field$) as avg_$field$`

Question 11

What is the most likely cause of the error?

Accepted Answer

The macro name in the definition contains an invalid character (backtick).. The error is most likely due to the backtick character in the macro definition name. In Splunk, macro names must consist only of alphanumeric characters and underscores; backticks are invalid and cause a parsing error. Option A is incorrect because the stem does not indicate whether positional or named arguments are used; the error is about the macro name itself. Option C is incorrect because a missing parenthesis would cause a syntax error, but the backtick is a more specific issue. Option D repeats the confusion of option A; the error is not about argument syntax but about the name containing an invalid character.

Answer

The macro definition uses positional arguments but the call uses named arguments.

Answer

The macro call is missing a closing parenthesis.

Answer

The macro call uses named arguments instead of positional arguments.

Question 12

A security analyst needs to monitor failed login attempts across multiple Windows domain controllers. The environment has a custom sourcetype 'WinEventLog:Security' and the data is indexed under 'windows_security'. The analyst wants to create a saved search that runs every 10 minutes, searches for EventCode 4625 (failed logon), and triggers an alert if more than 10 failures occur from the same source IP within the last 10 minutes. The saved search should use the Common Information Model (CIM) to ensure compatibility with other security apps. Which of the following saved search definitions best meets these requirements?

Accepted Answer

`| from datamodel:Authentication.All_Authentication where Authentication.EventCode=4625 | search Authentication.app=windows | timechart span=10m count by Authentication.src | where count > 10`. It uses the `from datamodel` command to query the CIM Authentication data model, specifically the `All_Authentication` dataset filtered for EventCode 4625 and Windows (`Authentication.app=windows`). The `timechart span=10m count by Authentication.src` then counts failures per source IP in 10-minute buckets, and the `where count > 10` triggers the alert only when the threshold is exceeded. This approach ensures CIM compatibility, uses the correct data model object, and respects the 10-minute sliding window required by the use case.

Answer

`index=windows_security sourcetype=WinEventLog:Security EventCode=4625 | stats count by src_ip | where count > 10`

Answer

`| from datamodel:Authentication.Failed_Authentication | where EventCode=4625 | stats count by src_ip | where count > 10`

Answer

`index=windows_security EventCode=4625 | transaction src_ip maxspan=10m | where eventcount > 10`

Question 13

A Splunk administrator notices that a scheduled saved search titled 'Nightly_Threat_Report' is not completing on time. The search runs at 2:00 AM daily and typically takes 15 minutes, but recently it has been timing out after 30 minutes. The search query is complex, joining data from multiple indexes. The administrator checks the 'savedsearch.log' and sees entries like 'Search job terminated due to dispatch time limit' and 'Search job exceeded max time'. The administrator wants to resolve the issue without changing the search logic or increasing system resource limits. Which action should the administrator take first?

Accepted Answer

Increase the 'dispatch.max_time' parameter for the saved search in savedsearches.conf.. The error messages 'Search job terminated due to dispatch time limit' and 'Search job exceeded max time' directly indicate that the search is hitting the 'dispatch.max_time' limit, which defaults to 600 seconds (10 minutes) for scheduled searches. Increasing this parameter in savedsearches.conf extends the maximum execution time allowed for the search job, allowing the complex query to complete without changing the search logic or system resource limits.

Answer

Change the scheduled time to 1:00 AM to avoid other concurrent heavy searches.

Answer

Increase the 'dispatch.earliest_time' and 'dispatch.latest_time' settings for the saved search to allow a longer execution window.

Answer

Reduce the search time range from 'last 24 hours' to 'last 1 hour' to speed up the query.

Question 14

A Splunk admin has created several macros to simplify complex search commands. One macro, named `time_filter`, is defined as `earliest=-7d@d latest=@d`. The admin also has a saved search that uses this macro. Recently, users have complained that the saved search reports data from the wrong time range: it appears to be showing data from the last 24 hours instead of the last 7 days. The admin inspects the saved search and finds that the search string is:

`index=main | eval days=now() | where days > relative_time(now(), "-7d@d") | `time_filter``

The admin suspects the macro is not being expanded correctly. Which of the following is the most likely cause of the issue?

Accepted Answer

The macro is disabled; the admin needs to enable it in the macros list.. The macro `time_filter` is defined as `earliest=-7d@d latest=@d`, but if it is disabled, it will not be expanded when invoked with backticks. Consequently, the search runs without the specified time range, defaulting to the last 24 hours, which explains the user reports. The admin should verify and enable the macro in the settings.

Answer

The macro definition includes arguments (`$earliest$`, `$latest$`), but the invocation does not pass any arguments; thus, the macro expands to nothing.

Answer

The saved search permissions are set to 'Private', so the macro does not apply.

Answer

The macro should be invoked with a pipe, like `| time_filter` instead of backticks.

Question 15

Match each Splunk knowledge object to its purpose.

Accepted Answer

Event types: Categorize events based on search criteria.. Knowledge objects in Splunk help organize and enrich data. Event types group events by criteria, Tags label field values, Lookups add external data, and Macros store reusable search fragments. Common confusions arise between these similar but distinct objects.

Answer

Event types: Add descriptive keywords to field values.

Answer

Tags: Categorize events based on search criteria.

Answer

Lookups: Reusable search fragments.

Question 16

Match each Splunk macro to its definition.

Accepted Answer

mvfilter: Filters multivalue fields based on a condition.. The correct matches are: mvfilter for filtering multivalue fields, dedup for removing duplicates, fields for removing fields, and rename for renaming fields. Common confusions include associating dedup with time formatting and fields with sorting.

Answer

dedup: Changes the time format of events.

Answer

fields: Sorts results by a field.

Question 17

Match each Splunk license violation type to its consequence.

Accepted Answer

Warning: Splunk continues to function normally but license warnings appear in the Monitoring Console.. Splunk license violations have two states: Warning (grace period with alerts) and Violation (search restricted for non-admins). Common mistakes include confusing the two or expecting immediate indexing stoppage.

Answer

Warning: Search is disabled for all users until license is renewed.

Answer

Violation: Splunk continues to function normally with no visible changes.

Answer

Warning: Indexing stops and all data ingestion is paused.

Answer

Violation: License warnings appear only in the Monitoring Console, no other impact.

Question 18

A Splunk user wants to create a macro named `nunique` that takes a field name as an argument and returns the count of distinct values for that field. Which macro definition should be used?

Accepted Answer

`nunique($1$)` defined as `stats dc($1$) as distinct_count`. The correct macro definition uses `$1$` for the argument and does not include a leading pipe. The macro `nunique($1$)` defined as `stats dc($1$) as distinct_count` is correct because it uses positional argument syntax and the stats command without a leading pipe, allowing it to be invoked mid-search. The leading pipe is only needed if the macro is invoked at the start of a search or after a pipe.

Answer

`nunique($field$)` defined as `stats dc($field$) as distinct_count`

Answer

`nunique($field$)` defined as `| stats dc($field$) as distinct_count`

Answer

`nunique($1$)` defined as `| stats dc($1$) as distinct_count`

Question 19

A Splunk admin needs to schedule a search to run every day at 2 AM and send an email alert if more than 100 events are found. Which saved search configuration achieves this?

Accepted Answer

Set schedule to 'Daily' at 02:00, trigger on 'Number of Events' > 100, action 'Email'. In Splunk's saved search scheduling UI, the correct trigger for 'alert when more than 100 events are found' is the 'Number of Events' trigger type, and the alert action is labelled 'Email' (or 'Send email' depending on version). Setting the schedule to 'Daily' at 02:00 with trigger 'Number of Events' > 100 and action 'Email' matches the requirement exactly. This is the standard Splunk alert configuration for event-count-based thresholds.

Answer

Set schedule to 'Daily' at 02:00, trigger on 'Custom condition' `search result count > 100`, action 'Send email'

Answer

Set schedule to 'Every day' at 2:00, trigger on 'Number of Events' > 100, action 'Send email'

Answer

Set schedule to 'Daily' at 02:00, trigger on 'Result count' > 100, action 'Email'

Question 20

A Splunk admin creates a macro named `lookup_user` that is defined as `| lookup user_lookup user AS $1$ OUTPUT full_name as user_name`. The macro is used in a search like `index=main | `lookup_user(user_id)`. However, the results show no matches even though valid user_id values exist. What is the most likely cause?

Accepted Answer

The macro definition incorrectly includes a leading pipe. The macro definition `| lookup user_lookup user AS $1$ OUTPUT full_name as user_name` begins with a pipe character. When a macro is invoked inline within a search (e.g., `index=main | `lookup_user(user_id)``), Splunk expands the macro text directly at the point of invocation. If the macro definition already includes a leading pipe, the expanded search becomes `index=main | | lookup user_lookup user AS user_id OUTPUT full_name as user_name`. The double pipe (`| |`) is invalid syntax and causes the search to fail or produce no results. The correct macro definition should omit the leading pipe: `lookup user_lookup user AS $1$ OUTPUT full_name as user_name`.

Answer

The macro is missing a closing parenthesis

Answer

The lookup file does not have a field named `user`

Answer

The lookup command should be `inputlookup` instead of `lookup`