SPLK-1002 Macros, Saved Searches and CIM Practice Test 3 — 15 Questions

Question 1

A Splunk admin wants to create a saved search that triggers an alert when the average CPU usage across all servers exceeds 80% over a 5-minute window. The data is in a 'perfmon' sourcetype. Which search best fits this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

index=os sourcetype=perfmon counter="% Processor Time" earliest=-5m latest=now | bucket _time span=5m | stats avg(Value) as avg_cpu by host | where avg_cpu > 80. It uses `earliest=-5m latest=now` to restrict the time range to the last 5 minutes, `bucket _time span=5m` to explicitly define the 5-minute window (even though the range is exactly 5 minutes, this ensures proper grouping for saved searches that may run later), `stats avg(Value) as avg_cpu by host` to compute the average per host within that window, and `where avg_cpu > 80` to filter hosts exceeding 80%. Option A uses `timechart`, which creates a separate series per time bucket and host, making the `where` clause ineffective (it would try to compare a field that doesn't exist). Option B omits the `bucket`, so the average is computed over the entire 5-minute range without explicit windowing, which can cause issues if the saved search runs with a different time range. Option C uses `streamstats`, which calculates a running average rather than a fixed-window average, not matching the requirement.

Answer

index=os sourcetype=perfmon counter="% Processor Time" | timechart avg(Value) as avg_cpu by host | where avg_cpu > 80

Answer

index=os sourcetype=perfmon counter="% Processor Time" earliest=-5m latest=now | stats avg(Value) as avg_cpu by host | where avg_cpu > 80

Answer

index=os sourcetype=perfmon counter="% Processor Time" | streamstats avg(Value) as avg_cpu by host | where avg_cpu > 80

Question 2

Which THREE are valid uses of macros in Splunk? (Choose three.)

Accepted Answer

Enforce security by hiding sensitive parts of the search from users.. Option B is correct because Splunk search macros can be used to encapsulate sensitive logic or field names and restrict visibility through knowledge object permissions, effectively hiding parts of a search from users who lack access to the macro definition. Option D is correct because macros are reusable SPL snippets that eliminate duplicated search language by letting multiple saved searches or dashboards reference the same macro definition. Option E is correct because macros support arguments (for example, $arg1$, $arg2$) that allow parameterization of values such as time ranges or thresholds at search time. Option A is not a valid macro use because index selection is controlled by the search's index clause and role-based index permissions, not by macros dynamically switching indexes based on user input. Option C is not a valid macro use because post-processing of completed search results is performed by post-process searches in dashboards or by commands like stats, not by macros.

Answer

Dynamically switch between different indexes at search time based on user input.

Answer

Modify the results of a search after the search completes (post-processing).

Question 3

Which TWO are correct about saved search permissions and scheduling? (Choose two.)

Accepted Answer

A saved search's permissions can be set to 'global' so that any user can run it.. Option A is correct because a saved search's permissions can be set to 'global', which grants every user in the Splunk deployment the ability to run and view that search regardless of role. Option D is correct because when a saved search is scheduled, the search executes under the permissions of the user who owns the saved search (the owner), not under the permissions of whoever later views the results, which is why the owner's role and capabilities determine what data the scheduled job can access. The unmarked options are incorrect: not every user can schedule a saved search (scheduling requires the 'schedule_search' capability, so B is false), a report does not automatically inherit the app's default permissions (permissions are explicitly set or inherited from the app context but not automatically granted to all, so C is false), and saved searches are private by default rather than visible to everyone (so E is false).

Answer

Any user can schedule a saved search regardless of role.

Answer

A saved search that is a report automatically inherits the app's default permissions.

Answer

All saved searches are visible to everyone in the app by default.

Question 4

The admin calls the macro as shown. What will be the expanded search string?

Accepted Answer

search index=main earliest=-1h latest=now | stats count by sourcetype | rename count as total. Macro arguments are substituted: $index$ becomes 'main', $time_range$ becomes '-1h'. The brackets define the search inside. Option B incorrectly concatenates. Option C uses single quotes. Option D swaps order.

Answer

search index='main' earliest='-1h' latest=now | stats count by sourcetype | rename count as total

Answer

search index=-1h earliest=main latest=now | stats count by sourcetype | rename count as total

Answer

search index=main|earliest=-1h latest=now | stats count by sourcetype | rename count as total

Question 5

What is the most likely reason for this behavior?

Accepted Answer

The 'max_time' setting limits the accelerated data to the last 1 day, so tstats only queries that time range.. The 'max_time' setting in the acceleration configuration limits the accelerated data to the last 1 day. When using tstats, it only queries this accelerated time range, ignoring the 'earliest_time' of -7d in the search. Therefore, even though the search spans 7 days, tstats returns results only from the last 24 hours because the acceleration does not cover the older data.

Answer

The acceleration summaries are only generated at the 5-minute and 1-hour intervals, not daily.

Answer

The acceleration is disabled because 'enabled' is set to true incorrectly.

Answer

The acceleration automatically becomes outdated after 1 day and requires a rebuild.

Question 6

What is the most likely cause of this error?

Accepted Answer

The endpoint "/services/authentication/users" is incorrect; it should be "/services/authentication/users". Actually the correct endpoint is '/services/authentication/users' but the admin might have a typo.. The error message indicates a URL not found, which is typically caused by an incorrect REST endpoint path. Option D correctly identifies that the endpoint '/services/authentication/users' may have a typo in the macro definition. Even if the path appears correct, a subtle typo (such as an extra character or incorrect casing) would cause the REST command to fail with a 'URL not found' error. Options A, B, and C are not related to endpoint path errors.

Answer

The macro does not have read permissions for the administrator's role.

Answer

The macro is missing the '|' pipe in front of the rest command.

Answer

The macro definition should use curly braces {} instead of brackets [].

Question 7

An administrator defines a macro that calls another macro. Both macros are defined in the same app. The first macro works correctly, but when executed, it triggers an error: 'Recursive macro call detected'. What is the most likely cause?

Accepted Answer

The second macro calls the first macro, creating a circular reference.. Splunk detects and prevents recursive macro calls (a macro that directly or indirectly calls itself). The error indicates that the two macros form a circular reference. Option B is correct. Option A (argument mismatch) would give a different error. Option C (permissions) is not relevant. Option D (syntax error) would also give a different error.

Answer

The second macro is not shared to the global context.

Answer

The first macro has a syntax error that only appears when combined.

Answer

The first macro passes incorrect arguments to the second macro.

Question 8

A Splunk administrator uses a macro to normalize firewall logs into the CIM Network Traffic data model. The macro includes a field alias that maps `bytes_sent` to `bytes_out`. The mapping works in ad-hoc searches, but when the macro is used in a summary index search, the field is not populated. What is the most likely reason?

Accepted Answer

The alias creates a new field that is not included in the summary index output.. Field aliases in Splunk create a new field name that points to an existing field at search time, but the alias itself is not a stored field. When a summary index search runs, it typically uses 'collect' or 'sistats' to write only the fields explicitly present in the results — the aliased field (bytes_out) is not automatically included unless it is explicitly referenced or the alias is applied downstream. This is why the mapping works in ad-hoc searches but not in the summary index output.

Answer

The summary index is accelerated and overrides the alias.

Answer

Field aliases are not supported in macros.

Answer

The macro is not shared to the global context, so it fails in summary indexing.

Question 9

Which TWO of the following are valid considerations when defining macros in Splunk?

Accepted Answer

Macros can be imported from other apps if they are shared globally.. Option A is correct because Splunk macros defined with global sharing permissions (shared: global) are visible across all apps, allowing them to be imported and reused in searches from other apps. Option D is correct because a macro's name (including its namespace) must be unique within the app where it is defined; Splunk will not allow two macros with the same name in the same app, as this would create ambiguity when the macro is invoked. Option B is incorrect because macros can absolutely contain transforming commands such as stats, chart, or timechart; there is no restriction against them. Option C is incorrect because macros can accept multiple arguments, which are referenced positionally as $arg1$, $arg2$, and so on. Option E is incorrect because macro definitions are created and managed through Settings > Advanced Search > Search Macros (or via configuration files), not directly in the search bar.

Answer

Macros cannot contain transforming commands.

Answer

Macros can only accept a single argument.

Answer

Macro definitions can be created directly in the search bar.

Question 10

Which THREE are components of the Common Information Model (CIM) in Splunk?

Accepted Answer

Tags. In Splunk's Common Information Model (CIM), the three core components are tags, data models, and field extractions. Option A (Tags) is correct because CIM relies on event types and tags to categorize and normalize raw events into CIM-compliant categories such as authentication, network traffic, or web. Option B (Data models) is correct because CIM data models define the hierarchical structure of normalized fields and objects (e.g., Authentication, Network_Traffic) that map raw data to a common schema. Option D (Field extractions) is correct because field extractions, often defined via props.conf/transforms.conf or the field extractor, populate the CIM-named fields (e.g., src, dest, user, action) that the data models expect. Option C (Lookup tables) is not a CIM component; lookups are a general Splunk knowledge object used for enrichment, not part of the CIM structure. Option E (Dashboards) is not a CIM component; dashboards are visualization artifacts built on searches, not part of the CIM normalization framework.

Answer

Lookup tables

Answer

Dashboards

Question 11

A Splunk admin wants to create a macro named `filter_by_app` that accepts an application name as an argument and returns a search string filtering by that application. The application name may contain spaces. Which of the following correctly defines the macro's arguments and usage?

Accepted Answer

Definition: `filter_by_app($app$)` and usage: `index=main app="$app$"`. Macro arguments must be referenced with $arg$ syntax and when the value contains spaces, it must be quoted. Option A defines the argument numerically (1) and uses $1$ without quotes, which fails for spaces. Option B defines the argument with $app$ (invalid syntax for definition) and uses $app$ without quotes. Option D defines 'app' without dollar signs, so the usage treats 'app' as literal text, not a variable. Option E uses $1 without a trailing dollar sign, which is invalid.

Answer

Definition: `filter_by_app(1)` and usage: `index=main app=$1$`

Answer

Definition: `filter_by_app($app$)` and usage: `index=main app=$app$`

Answer

Definition: `filter_by_app(app)` and usage: `index=main app=app`

Answer

Definition: `filter_by_app($1)` and usage: `index=main app=$1`

Question 12

An administrator configures a saved search that uses a macro to generate a summary index every hour. The macro includes a time range argument with default value `earliest=-1h@h latest=@h`. The saved search does not pass any time range argument, so the default is used. After a few days, the summary index is missing data for the last hour of each day. What is the most likely cause?

Accepted Answer

The macro definition used a static time range (e.g., `earliest=08:00:00 latest=09:00:00`) instead of a relative one.. If the macro definition uses a static time range (e.g., `earliest=08:00:00 latest=09:00:00`), it will always summarize data from that specific fixed hour regardless of when the search runs. Since the saved search runs every hour using the macro's default, it repeatedly summarizes the same hour (e.g., 08:00-09:00) and never covers the last hour of the day (e.g., 23:00-00:00). This causes missing data for the final hour of each day. Relative time ranges like `earliest=-1h@h` adjust to the current time and cover the most recent completed hour, avoiding such gaps.

Answer

The saved search schedule is set to run on the hour, but the macro's default time range covers the previous hour, creating an overlap.

Answer

The macro is defined in a private app, and the saved search runs in a different app, causing the macro default not to be used.

Answer

The saved search's summary index is configured with a summary range that is too short, causing old data to be aged out.

Question 13

A security team uses the CIM 'Authentication' data model to investigate failed logins. They have enabled acceleration on the data model and set a summary range of '1d'. After one week, searches against the data model are still slow and use the `search` command instead of `tstats`. What should they check first?

Accepted Answer

Confirm that the data model acceleration is built and that the search time range is within the summary range.. Data model acceleration creates pre-computed tsidx files that allow tstats to query the model quickly. If the search time range falls outside the configured summary range (here '1d'), Splunk cannot use the accelerated summaries and silently falls back to raw search. Likewise, if acceleration has not finished building or is disabled, tstats returns nothing and the search reverts to the search command. Checking acceleration status and time-range alignment is therefore the first diagnostic step.

Answer

Verify that the 'Authentication' data model is assigned to the correct index.

Answer

Ensure that the 'Authentication' data model has the 'authentication' tag on relevant events.

Answer

Check that the data model acceleration has completed building for the exact time range of the search.

Question 14

A security analyst sets up a saved search alert to trigger when more than 100 failed logins occur in 5 minutes. To avoid alert fatigue, they want to suppress the alert if the number of failed logins is the same as the previous evaluation. Which alert action setting should they configure?

Accepted Answer

Enable 'Alert suppression' and set 'Suppress if results are the same as the previous search'.. Enabling 'Alert suppression' and setting 'Suppress if results are the same as the previous search' is the correct setting because it specifically suppresses alerts when the search results are identical to the previous run, which directly addresses the requirement to avoid alert fatigue when the number of failed logins is the same as the previous evaluation.

Answer

Enable 'Alert throttling' based on the 'src' field.

Answer

Set the 'Throttle' field to suppress alerts for a specified time window.

Answer

Configure 'Alert severity' to low and set a delay.

Question 15

A data engineer has defined a CIM data model for 'Network_Traffic'. They have also created field aliases using `| fieldaliases` to map custom fields like `src_ip` and `dest_ip` to the CIM fields. When running searches against the data model, some events do not appear. The engineer verified that the tags are correctly applied. What is the most likely remaining issue?

Accepted Answer

The field aliases must be defined within the data model itself, not via `| fieldaliases`.. In Splunk CIM, field aliases used by data models must be defined within the data model's field definitions or via the data model's constraints — not through the search-time `fieldaliases` command. The `fieldaliases` command only applies within the search pipeline where it is invoked and does not persist into the data model's acceleration or tstats-based searches. Therefore, events whose custom fields are only aliased via `| fieldaliases` will not match the data model's CIM field expectations.

Answer

The data model search is using a time range that excludes the events.

Answer

The custom fields are not indexed, so they cannot be used in data models.

Answer

The tags are applied only to a subset of events.