SPLK-1003 Macros, Saved Searches and CIM Practice Test 2 — 15 Questions

Question 1

A security analyst needs to monitor failed login attempts across multiple Windows domain controllers. The environment has a custom sourcetype 'WinEventLog:Security' and the data is indexed under 'windows_security'. The analyst wants to create a saved search that runs every 10 minutes, searches for EventCode 4625 (failed logon), and triggers an alert if more than 10 failures occur from the same source IP within the last 10 minutes. The saved search should use the Common Information Model (CIM) to ensure compatibility with other security apps. Which of the following saved search definitions best meets these requirements?

Accepted Answer

`| from datamodel:Authentication.All_Authentication where Authentication.EventCode=4625 | search Authentication.app=windows | timechart span=10m count by Authentication.src | where count > 10`. Option A is correct because it uses the `from datamodel` command to query the CIM Authentication data model, specifically the `All_Authentication` dataset filtered for EventCode 4625 and Windows (`Authentication.app=windows`). The `timechart span=10m count by Authentication.src` then counts failures per source IP in 10-minute buckets, and the `where count > 10` triggers the alert only when the threshold is exceeded. This approach ensures CIM compatibility, uses the correct data model object, and respects the 10-minute sliding window required by the use case.

Answer

`index=windows_security sourcetype=WinEventLog:Security EventCode=4625 | stats count by src_ip | where count > 10`

Answer

`| from datamodel:Authentication.Failed_Authentication | where EventCode=4625 | stats count by src_ip | where count > 10`

Answer

`index=windows_security EventCode=4625 | transaction src_ip maxspan=10m | where eventcount > 10`

Question 2

A Splunk administrator notices that a scheduled saved search titled 'Nightly_Threat_Report' is not completing on time. The search runs at 2:00 AM daily and typically takes 15 minutes, but recently it has been timing out after 30 minutes. The search query is complex, joining data from multiple indexes. The administrator checks the 'savedsearch.log' and sees entries like 'Search job terminated due to dispatch time limit' and 'Search job exceeded max time'. The administrator wants to resolve the issue without changing the search logic or increasing system resource limits. Which action should the administrator take first?

Accepted Answer

Increase the 'dispatch.max_time' parameter for the saved search in savedsearches.conf.. Option B is correct because the error messages 'Search job terminated due to dispatch time limit' and 'Search job exceeded max time' directly indicate that the search is hitting the 'dispatch.max_time' limit, which defaults to 600 seconds (10 minutes) for scheduled searches. Increasing this parameter in savedsearches.conf extends the maximum execution time allowed for the search job, allowing the complex query to complete without changing the search logic or system resource limits.

Answer

Change the scheduled time to 1:00 AM to avoid other concurrent heavy searches.

Answer

Increase the 'dispatch.earliest_time' and 'dispatch.latest_time' settings for the saved search to allow a longer execution window.

Answer

Reduce the search time range from 'last 24 hours' to 'last 1 hour' to speed up the query.

Question 3

Which TWO of the following are valid reasons to use the Common Information Model (CIM) in a Splunk environment?

Accepted Answer

It improves the ability to correlate events from different technologies.. Option A is correct because the Common Information Model (CIM) provides a standardized set of field names and event tags across different data sources, enabling correlation of events from disparate technologies (e.g., firewalls, IDS, endpoints) using common fields like 'dest_ip', 'src_ip', 'user', and 'action'. This normalization allows Splunk to join or relate events that share the same CIM-compliant fields, making it possible to build coherent security or operational stories across heterogeneous data.

Answer

It improves search performance by pre-aggregating data.

Answer

It provides built-in security monitoring use cases.

Answer

It eliminates the need for custom field extractions.

Question 4

A Splunk admin has created several macros to simplify complex search commands. One macro, named `time_filter`, is defined as `earliest=-7d@d latest=@d`. The admin also has a saved search that uses this macro. Recently, users have complained that the saved search reports data from the wrong time range: it appears to be showing data from the last 24 hours instead of the last 7 days. The admin inspects the saved search and finds that the search string is:

`index=main | eval days=now() | where days > relative_time(now(), "-7d@d") | `time_filter``

The admin suspects the macro is not being expanded correctly. Which of the following is the most likely cause of the issue?

Accepted Answer

The macro definition includes arguments (`$earliest$`, `$latest$`), but the invocation does not pass any arguments; thus, the macro expands to nothing.. Option A is correct because the macro `time_filter` is defined without any arguments (no `$arg$` placeholders), but the admin suspects it is not expanding correctly. However, the real issue is that the macro invocation uses backticks, which is the correct syntax for inline macro expansion in Splunk. The problem is that the saved search already includes an explicit `earliest` and `latest` time range via the `time_filter` macro, but the search also uses `relative_time(now(), "-7d@d")` in a `where` clause, which overrides the macro's time range. The macro `time_filter` expands to `earliest=-7d@d latest=@d`, which sets the search time range to the last 7 days, but the `where` clause filters events to only those where `days > relative_time(now(), "-7d@d")`, which is effectively the last 24 hours because `now()` returns the current time and `relative_time(now(), "-7d@d")` returns the start of the day 7 days ago, so the condition `days > ...` is always true for any event, but the `days` field is set to `now()` for every event, so the filter does not actually restrict the time range; the real time range is controlled by the macro. The confusion is that the macro is expanding correctly, but the `where` clause is not needed and may be causing the perception of wrong data. However, the most likely cause of the issue is that the macro is not being expanded because the saved search is using backticks, which is correct, but the macro definition might be missing the required `$earliest$` and `$latest$` arguments if the admin intended to pass them. But the question states the macro is defined as `earliest=-7d@d latest=@d` without arguments, so it should expand. The correct answer is A because the macro definition includes arguments (`$earliest$`, `$latest$`), but the invocation does not pass any arguments; thus, the macro expands to nothing. This is a common mistake: if a macro is defined with parameters, the invocation must supply values for those parameters, otherwise the macro expands to an empty string.

Answer

The saved search permissions are set to 'Private', so the macro does not apply.

Answer

The macro should be invoked with a pipe, like `| time_filter` instead of backticks.

Answer

The macro is disabled; the admin needs to enable it in the macros list.

Question 5

Order the steps to configure a field extraction using the Field Extractor (FX) in Splunk.

Question 6

Order the steps to create a data model in Splunk in the correct order.

Question 7

Order the steps to create a dashboard panel using the XML source editor in Splunk.

Question 8

Match each Splunk knowledge object to its purpose.

Question 9

Match each Splunk macro to its definition.

Question 10

Match each Splunk license violation type to its consequence.

Question 11

A Splunk user wants to create a macro named `nunique` that takes a field name as an argument and returns the count of distinct values for that field. Which macro definition should be used?

Accepted Answer

`nunique($1$)` defined as `stats dc($1$) as distinct_count`. Option A is correct because macro definitions should not include a leading pipe when the macro is invoked with a pipe. Positional arguments ($1$) are standard. Option B incorrectly includes a pipe. Options C and D use a named argument without defining the argument name in the macro properties, which is less common and not standard practice.

Answer

`nunique($field$)` defined as `stats dc($field$) as distinct_count`

Answer

`nunique($field$)` defined as `| stats dc($field$) as distinct_count`

Answer

`nunique($1$)` defined as `| stats dc($1$) as distinct_count`

Question 12

A Splunk admin needs to schedule a search to run every day at 2 AM and send an email alert if more than 100 events are found. Which saved search configuration achieves this?

Accepted Answer

Set schedule to 'Daily' at 02:00, trigger on 'Number of Events' > 100, action 'Email'. Option C is correct: Splunk schedules allow 'Daily' with a specific time, but the trigger condition is 'Number of Events' > 100, and 'Email' action. Option A uses 'Result count' which is not a standard trigger condition name. Option B uses cron with a custom condition string that is not valid. Option D uses 'Custom condition' with incorrect syntax.

Answer

Set schedule to 'Daily' at 02:00, trigger on 'Custom condition' `search result count > 100`, action 'Send email'

Answer

Set schedule to 'Every day' at 2:00, trigger on 'Number of Events' > 100, action 'Send email'

Answer

Set schedule to 'Daily' at 02:00, trigger on 'Result count' > 100, action 'Email'

Question 13

An organization is implementing the Splunk Common Information Model (CIM) to normalize data. They have a source that provides event data with field names `src_ip` and `dst_ip`. To map these to CIM fields, which knowledge object should be created?

Accepted Answer

A field alias to create `src` from `src_ip` and `dest` from `dst_ip`. Option B is correct: Field aliases allow mapping source-specific field names to CIM field names without modifying the raw data. Option A would require an extraction, which is not standard for renaming. Option C calculated fields compute new fields but are not meant for simple renaming. Option D tags are for categorization, not field mapping.

Answer

A tag to tag events with `src_ip` and `dst_ip` as network traffic

Answer

A field extraction to rename `src_ip` to `src` and `dst_ip` to `dest`

Answer

A calculated field to set `src=src_ip` and `dest=dst_ip`

Question 14

A search includes the macro `mysearch(field1, field2)`. The macro definition is `stats count by $1$, $2$`. If the search is `index=main | `mysearch(user, action)`, what is the expanded search?

Answer

`index=main | stats count by $1$, $2$`

Answer

`index=main | | stats count by user, action`

Answer

`index=main | mysearch(user, action)`

Answer

`index=main | stats count by user, action`

Question 15

A saved search is configured to run every hour and generate a summary index. The original search returns data that is then summarized. Which of the following best describes the purpose of summary indexing?

Accepted Answer

To speed up searches by pre-aggregating data into smaller datasets. Option B is correct: Summary indexing precomputes statistics from a search and stores them in a summary index, which can then be searched faster. Option A is not accurate; summary indexing doesn't compress raw data. Option C is about alerts. Option D is about CIM.

Answer

To reduce disk space usage by compressing raw data

Answer

To create real-time alerts based on historical data

Answer

To normalize data to the CIM