SPLK-1002 Macros, Saved Searches and CIM Practice Test 2 — 15 Questions

Question 1

Match each Splunk macro to its definition.

Accepted Answer

mvfilter: Filters multivalue fields based on a condition.. The correct matches are: mvfilter for filtering multivalue fields, dedup for removing duplicates, fields for removing fields, and rename for renaming fields. Common confusions include associating dedup with time formatting and fields with sorting.

Answer

dedup: Changes the time format of events.

Answer

fields: Sorts results by a field.

Question 2

Match each Splunk license violation type to its consequence.

Accepted Answer

Warning: Splunk continues to function normally but license warnings appear in the Monitoring Console.. Splunk license violations have two states: Warning (grace period with alerts) and Violation (search restricted for non-admins). Common mistakes include confusing the two or expecting immediate indexing stoppage.

Answer

Warning: Search is disabled for all users until license is renewed.

Answer

Violation: Splunk continues to function normally with no visible changes.

Answer

Warning: Indexing stops and all data ingestion is paused.

Answer

Violation: License warnings appear only in the Monitoring Console, no other impact.

Question 3

A Splunk user wants to create a macro named `nunique` that takes a field name as an argument and returns the count of distinct values for that field. Which macro definition should be used?

Accepted Answer

`nunique($1$)` defined as `stats dc($1$) as distinct_count`. The correct macro definition uses `$1$` for the argument and does not include a leading pipe. The macro `nunique($1$)` defined as `stats dc($1$) as distinct_count` is correct because it uses positional argument syntax and the stats command without a leading pipe, allowing it to be invoked mid-search. The leading pipe is only needed if the macro is invoked at the start of a search or after a pipe.

Answer

`nunique($field$)` defined as `stats dc($field$) as distinct_count`

Answer

`nunique($field$)` defined as `| stats dc($field$) as distinct_count`

Answer

`nunique($1$)` defined as `| stats dc($1$) as distinct_count`

Question 4

A Splunk admin needs to schedule a search to run every day at 2 AM and send an email alert if more than 100 events are found. Which saved search configuration achieves this?

Accepted Answer

Set schedule to 'Daily' at 02:00, trigger on 'Number of Events' > 100, action 'Email'. In Splunk's saved search scheduling UI, the correct trigger for 'alert when more than 100 events are found' is the 'Number of Events' trigger type, and the alert action is labelled 'Email' (or 'Send email' depending on version). Setting the schedule to 'Daily' at 02:00 with trigger 'Number of Events' > 100 and action 'Email' matches the requirement exactly. This is the standard Splunk alert configuration for event-count-based thresholds.

Answer

Set schedule to 'Daily' at 02:00, trigger on 'Custom condition' `search result count > 100`, action 'Send email'

Answer

Set schedule to 'Every day' at 2:00, trigger on 'Number of Events' > 100, action 'Send email'

Answer

Set schedule to 'Daily' at 02:00, trigger on 'Result count' > 100, action 'Email'

Question 5

A Splunk admin creates a macro named `lookup_user` that is defined as `| lookup user_lookup user AS $1$ OUTPUT full_name as user_name`. The macro is used in a search like `index=main | `lookup_user(user_id)`. However, the results show no matches even though valid user_id values exist. What is the most likely cause?

Accepted Answer

The macro definition incorrectly includes a leading pipe. The macro definition `| lookup user_lookup user AS $1$ OUTPUT full_name as user_name` begins with a pipe character. When a macro is invoked inline within a search (e.g., `index=main | `lookup_user(user_id)``), Splunk expands the macro text directly at the point of invocation. If the macro definition already includes a leading pipe, the expanded search becomes `index=main | | lookup user_lookup user AS user_id OUTPUT full_name as user_name`. The double pipe (`| |`) is invalid syntax and causes the search to fail or produce no results. The correct macro definition should omit the leading pipe: `lookup user_lookup user AS $1$ OUTPUT full_name as user_name`.

Answer

The macro is missing a closing parenthesis

Answer

The lookup file does not have a field named `user`

Answer

The lookup command should be `inputlookup` instead of `lookup`

Question 6

A macro is defined as `mysearch` with definition `index=main | stats count by $source_type$`. The macro is invoked as `| `mysearch(access_combined)` but the search never finishes. What is the likely issue?

Accepted Answer

The macro definition uses a named argument but the invocation passes an unnamed argument. The macro definition uses `$source_type$` which is a named argument. In the invocation `| `mysearch(access_combined)``, the argument is passed positionally without the argument name. For named arguments, the invocation must specify the argument name, like `source_type=access_combined`. This mismatch causes the macro to treat `$source_type$` as a literal string instead of substituting the passed value, leading to the search never finishing because it's probably looking for a field that doesn't exist. Option B is incorrect because the quotes are not the issue; the problem is the positional vs. named argument mismatch. Option A is incorrect because there is no syntax error in the definition. Option D is incorrect because a filter is not required before stats.

Answer

The macro definition contains a syntax error

Answer

The macro argument should not be in quotes

Answer

The macro definition requires a filter before the stats command

Question 7

Which of the following are valid ways to define a macro in Splunk? (Choose two.)

Accepted Answer

Using named arguments like $field$ in the definition, with the argument names defined in the macro properties. Options C and E are correct because Splunk macros support two argument styles: named arguments written as $field$ (or $argname$) in the definition, with the corresponding argument names declared in the macro's properties/definition, and positional arguments written as $1$, $2$, etc., which are passed by position when the macro is invoked. Both are legitimate ways to parameterize a macro definition in Splunk (via Settings > Advanced Search > Search macros or macros.conf). Options A and D are incorrect because there is no `macro` command or `define` command in the Splunk search processing language for creating macros; macros are defined in configuration, not by a search command. Option B is incorrect because `| macro` is not a valid way to define a macro — macros are invoked in searches by name (e.g., `| mymacro` or `` `mymacro` ``), not defined with a `macro` command.

Answer

Using the `macro` command in a saved search

Answer

Using the `| macro` command in a search

Answer

Using the `define` command in the search bar

Question 8

An admin is troubleshooting a saved search that uses the `| `my_macro` command. The macro definition is `stats count by $1$`. The saved search is scheduled to run hourly. Which of the following issues could cause the saved search to fail? (Choose three.)

Accepted Answer

The macro argument passed in the saved search contains a space without quotes. Option A is correct because when a macro argument contains a space, it must be enclosed in quotation marks; otherwise the macro parser splits the argument at the space, producing malformed search syntax and causing the saved search to fail. Option B is correct because a macro definition that already begins with a pipe (e.g., `| stats count by $1$`) must be invoked without a leading pipe in the search; writing `| `my_macro`` adds a second pipe, resulting in an invalid command sequence. Option D is correct because if the macro is not shared to the app where the saved search is stored, the search cannot resolve the macro name at runtime and will fail with an unknown macro error. Option C is not a failure cause, since 'All time' is a valid time range for a scheduled search. Option E is not a failure cause, because overlapping cron schedules do not inherently break a saved search; they may affect resource contention but not execution validity.

Answer

The saved search's time range is set to 'All time'

Answer

The saved search has a cron schedule that overlaps with another saved search

Question 9

Refer to the exhibit. The macro `count_by_host` is defined as shown. The macro is invoked as `| `count_by_host`. What will the expanded search look like?

Accepted Answer

`| | stats count by host, sourcetype`. When a Splunk search macro is invoked with a leading pipe (e.g., `| `count_by_host`), the macro's definition is substituted at that point. If the macro definition itself begins with a pipe (as shown in the exhibit, `| stats count by host, sourcetype`), the expansion results in two consecutive pipes: `| | stats count by host, sourcetype`. Splunk tolerates this double-pipe syntax and executes the stats command correctly, which is why option D is the literal expanded form.

Answer

`| stats count by host, sourcetype`

Answer

`| `count_by_host`

Answer

`stats count by host, sourcetype`

Question 10

Refer to the exhibit. A search uses the macro as `| `fillnull(field=user)`. However, the search fails with a syntax error. What is the most likely issue?

Accepted Answer

The macro definition contains unescaped commas. The macro definition likely contains unescaped commas, which Splunk interprets as argument separators, causing a syntax error when the macro is invoked with a single argument. In Splunk, commas in macro definitions must be escaped with a backslash.

Answer

The macro argument should be passed without the `field=` prefix

Answer

The macro definition should use positional arguments instead of named

Answer

The macro definition should include a pipe before `eval`

Question 11

A Splunk admin wants to create a reusable macro that accepts a time range parameter and searches all indexes for events within that range. The macro will be used in dashboards and reports. Which macro definition is correct?

Accepted Answer

define my_search($timerange$) [search index=* earliest=$timerange$]. A Splunk macro definition must wrap the search string in square brackets and use dollar-sign delimiters around the argument name. Option D does both: 'define my_search($timerange$) [search index=* earliest=$timerange$]'. The brackets tell Splunk the macro body is a search fragment, and the $...$ syntax correctly declares the argument.

Answer

define my_search($timerange) [search index=* earliest=$timerange]

Answer

define my_search($timerange$) search index=* earliest=$timerange$

Answer

define my_search($timerange$) <search index=* earliest=$timerange$>

Question 12

A Splunk administrator is asked to create a dashboard that shows the top 10 source IPs by count of failed logins over the past week. The data is already CIM-compliant and uses the Authentication data model. Which search is most appropriate?

Accepted Answer

| tstats count from datamodel=Authentication where Authentication.action=failure by Authentication.src limit 10. It uses the tstats command on the Accelerated Authentication data model, filters for Authentication.action=failure, and uses the src field (CIM-compliant source IP) with a limit of 10 to get the top source IPs by failed logins. Option B is incorrect because summaryonly=true prevents retrieval of individual event counts needed for the top 10, and the action field is not fully qualified as Authentication.action. Option C is incorrect because the datamodel command is less efficient than tstats for accelerated data models, and using top on the full dataset is resource-intensive. Option D is incorrect because it does not leverage the CIM data model acceleration and searches across all sourcetypes, which may include non-authentication data, making it less accurate.

Answer

| tstats summaryonly=true count from datamodel=Authentication where action=failure by src

Answer

| datamodel Authentication search | search action=failure | top src

Answer

| search sourcetype=* authentication action=failure | stats count by src | sort - count | head 10

Question 13

A security team has a saved search that runs every 5 minutes and looks for 'FAILED' events in Windows Security logs. The search uses a macro 'failed_logins' defined as: `define failed_logins() [search index=windows sourcetype=WinEventLog:Security EventCode=4625]`. Recently, the team noticed that the search is returning no results even though there are failed login events. What is the most likely issue?

Accepted Answer

The macro definition includes empty parentheses 'failed_logins()' but is being called without parentheses, causing Splunk to treat it as a different macro.. The macro is defined with empty parentheses 'failed_logins()', which means it takes no arguments and must be called as `failed_logins` (with backticks) — but if the search calls it as `failed_logins()` with parentheses, Splunk treats it as a different macro name and fails to resolve it, returning no results. This is the most likely cause of the empty results.

Answer

The macro does not have read permissions for the security team.

Answer

The macro must be called with backticks like `failed_logins` instead of pipe.

Answer

The sourcetype field is using a wildcard, which is deprecated.

Question 14

A large enterprise uses multiple Splunk search heads. An admin wants to create a saved search that automatically runs on all search heads and sends a single alert email per triggered result, not per search head. Which saved search setting should be configured?

Accepted Answer

Set Alert Type to 'Per Result' to trigger an alert for each matching event.. Setting the Alert Type to 'Per Result' ensures that an alert is triggered for each matching event in the search results. In a multi-search head environment, the saved search runs on all search heads, potentially causing duplicate alerts. However, to achieve a single alert per triggered result, you must first enable per-result alerting. Options such as throttling or using a dedicated search head can then be used to deduplicate. Option B (Alert Suppression) suppresses consecutive identical alerts from the same search, which does not address cross-head duplication. Options A and D are unrelated to the alerting mechanism. Therefore, C is the key setting among the choices.

Answer

Set the time range to 'Real-time' to capture events as they happen.

Answer

Enable 'Alert Suppression' to suppress duplicate alerts.

Answer

Set the Schedule to 'Continuous' to avoid duplicates.

Question 15

An admin notices that a saved search with a scheduled alert is not triggering as expected even though the search returns results. The search uses a macro with arguments. Which troubleshooting step should the admin take first?

Accepted Answer

Review the macro definition for syntax errors, such as missing brackets or incorrect argument references.. When a scheduled search with a macro using arguments does not trigger despite returning results, the first troubleshooting step is to review the macro definition for syntax errors, such as missing brackets or incorrect argument references. A malformed macro can cause the search to fail silently or not expand correctly in the scheduled context.

Answer

Ensure that the macro name does not conflict with existing commands or other macros.

Answer

Verify the macro's permissions are set to global.

Answer

Check the search head's job inspector for the expanded search string.