SPLK-1002 Macros, Saved Searches and CIM Practice Test 3 — 15 Questions

Question 1

A Splunk user wants to create a macro named `nunique` that takes a field name as an argument and returns the count of distinct values for that field. Which macro definition should be used?

Accepted Answer

`nunique($1$)` defined as `stats dc($1$) as distinct_count`. The correct macro definition is option B because it uses a positional argument ($1$) and does not include a leading pipe. In Splunk, macros are invoked as part of a pipe chain, so the definition should not start with a pipe. Positional arguments are standard and do not require predefined argument names, whereas named arguments must be defined in the macro properties. Option A fails because it uses a named argument ($field$) without defining it, making it invalid. Options C and D incorrectly include a leading pipe at the start of the definition, which would cause a syntax error when the macro is expanded within a pipe.

Answer

`nunique($field$)` defined as `stats dc($field$) as distinct_count`

Answer

`nunique($field$)` defined as `| stats dc($field$) as distinct_count`

Answer

`nunique($1$)` defined as `| stats dc($1$) as distinct_count`

Question 2

A Splunk admin needs to schedule a search to run every day at 2 AM and send an email alert if more than 100 events are found. Which saved search configuration achieves this?

Accepted Answer

Set schedule to 'Daily' at 02:00, trigger on 'Number of Events' > 100, action 'Email'. Splunk saved searches allow setting a schedule with 'Daily' at a specific time (02:00), and you can configure an alert trigger condition 'Number of Events' > 100, with action 'Email'. Option A uses 'Custom condition' with a string 'search result count > 100', which is not a standard trigger and the syntax is incorrect. Option B uses 'Every day' which is not a valid schedule option in Splunk; valid options include 'Daily'. Option D uses 'Result count' which is not a standard trigger condition name; the correct term is 'Number of Events'.

Answer

Set schedule to 'Daily' at 02:00, trigger on 'Custom condition' `search result count > 100`, action 'Send email'

Answer

Set schedule to 'Every day' at 2:00, trigger on 'Number of Events' > 100, action 'Send email'

Answer

Set schedule to 'Daily' at 02:00, trigger on 'Result count' > 100, action 'Email'

Question 3

An organization is implementing the Splunk Common Information Model (CIM) to normalize data. They have a source that provides event data with field names `src_ip` and `dst_ip`. To map these to CIM fields, which knowledge object should be created?

Accepted Answer

A field alias to create `src` from `src_ip` and `dest` from `dst_ip`. Field aliases allow mapping source-specific field names (src_ip, dst_ip) to CIM-standard field names (src, dest) without modifying raw data. Option A (tags) are for categorization, not field mapping. Option B (field extraction) extracts new fields but cannot rename existing ones. Option D (calculated fields) compute new fields from expressions, but simple renaming is better handled by aliases.

Answer

A tag to tag events with `src_ip` and `dst_ip` as network traffic

Answer

A field extraction to rename `src_ip` to `src` and `dst_ip` to `dest`

Answer

A calculated field to set `src=src_ip` and `dest=dst_ip`

Question 4

A search includes the macro `mysearch(field1, field2)`. The macro definition is `stats count by $1$, $2$`. If the search is `index=main | `mysearch(user, action)`, what is the expanded search?

Accepted Answer

`index=main | stats count by user, action`. The macro invocation `| `mysearch(user, action)` expands by replacing `$1$` with `user` and `$2$` with `action` in the definition `stats count by $1$, $2$`, resulting in `| stats count by user, action`. Option A incorrectly leaves the placeholders unreplaced. Option B has an extra pipe symbol, which would cause a syntax error. Option C does not expand the macro; it just references the macro name literally.

Answer

`index=main | stats count by $1$, $2$`

Answer

`index=main | | stats count by user, action`

Answer

`index=main | mysearch(user, action)`

Question 5

A saved search is configured to run every hour and generate a summary index. The original search returns data that is then summarized. Which of the following best describes the purpose of summary indexing?

Accepted Answer

To speed up searches by pre-aggregating data into smaller datasets. Summary indexing in Splunk is used to precompute and store aggregated results from a search, which allows subsequent searches to run much faster by querying the smaller summary index rather than the full raw data. Option D correctly describes this purpose. Option A is incorrect because summary indexing does not compress raw data; it creates new, summarized data. Option B is incorrect; summary indexing is not used for real-time alerts—alerts are separate. Option C is incorrect; summary indexing does not normalize data to the CIM; data model acceleration or other features do that.

Answer

To reduce disk space usage by compressing raw data

Answer

To create real-time alerts based on historical data

Answer

To normalize data to the CIM

Question 6

A Splunk admin creates a macro named `lookup_user` that is defined as `| lookup user_lookup user AS $1$ OUTPUT full_name as user_name`. The macro is used in a search like `index=main | `lookup_user(user_id)`. However, the results show no matches even though valid user_id values exist. What is the most likely cause?

Accepted Answer

The macro definition incorrectly includes a leading pipe. Because the macro is invoked with a pipe (`| `lookup_user...), the definition should not include a leading pipe. If it does, the expanded search becomes `| | lookup...`, which causes a syntax error or unexpected behavior. Option A could be possible but less likely; if the lookup file lacks the field `user`, the lookup would fail silently. Option B not likely. Option C inputlookup is for static lookups.

Answer

The macro is missing a closing parenthesis

Answer

The lookup file does not have a field named `user`

Answer

The lookup command should be `inputlookup` instead of `lookup`

Question 7

A Splunk admin is accelerating a CIM data model for the "Network_Traffic" dataset. After acceleration, some searches that use the data model are slower than expected. What is the most likely reason?

Accepted Answer

The acceleration summary range is set too low. Data model acceleration works by creating a summary of data within a specified time range (the summary range). If the summary range is set too low, searches that span beyond that range will not benefit from acceleration and may be slower as they have to scan the full raw data. Option A is incorrect; acceleration selects specific fields. Option B is false; CIM data models are compatible with acceleration. Option C is less specific and not the most likely reason.

Answer

The acceleration uses too many fields

Answer

The data model acceleration is not compatible with the CIM

Answer

Searches are not using the `| datamodel` command correctly

Question 8

A macro is defined as `mysearch` with definition `index=main | stats count by $source_type$`. The macro is invoked as `| `mysearch(access_combined)` but the search never finishes. What is the likely issue?

Accepted Answer

The macro definition uses a named argument but the invocation passes an unnamed argument. The macro definition uses `$source_type$` which is a named argument. In the invocation `| `mysearch(access_combined)``, the argument is passed positionally without the argument name. For named arguments, the invocation must specify the argument name, like `source_type=access_combined`. This mismatch causes the macro to treat `$source_type$` as a literal string instead of substituting the passed value, leading to the search never finishing because it's probably looking for a field that doesn't exist. Option B is incorrect because the quotes are not the issue; the problem is the positional vs. named argument mismatch. Option A is incorrect because there is no syntax error in the definition. Option D is incorrect because a filter is not required before stats.

Answer

The macro definition contains a syntax error

Answer

The macro argument should not be in quotes

Answer

The macro definition requires a filter before the stats command

Question 9

A saved search is configured with a schedule but is not triggering at the expected time. The admin checks the "Job Inspector" and sees that the scheduled search is "skipped". What is a common reason for a scheduled search to be skipped?

Accepted Answer

There are too many concurrent searches scheduled. Splunk can skip scheduled searches if there are too many concurrent searches due to scheduling limits. Option A would cause a failure, not skip. Option C might affect performance but not cause a skip. Option D real-time searches are not scheduled, so that is not relevant.

Answer

The search time range exceeds the bucket's time range

Answer

The search is configured as a real-time search

Answer

The search string has a syntax error

Question 10

Which of the following are valid ways to define a macro in Splunk? (Choose two.)

Accepted Answer

Using named arguments like $field$ in the definition, with the argument names defined in the macro properties. Options C and E are correct ways to define a macro in Splunk. Macros can use named arguments (e.g., $field$) with argument names defined in the macro properties, or positional arguments (e.g., $1$, $2$) that are referenced by position. Option A is incorrect because the `macro` command does not exist; macros are defined in Settings > Advanced Search > Search Macros. Option B is incorrect because there is no `| macro` search command. Option D is incorrect because there is no `define` command for macros; macros are defined in the knowledge object settings.

Answer

Using the `macro` command in a saved search

Answer

Using the `| macro` command in a search

Answer

Using the `define` command in the search bar

Question 11

Which of the following are characteristics of the Splunk Common Information Model (CIM)? (Choose three.)

Accepted Answer

It requires the installation of the Splunk Common Information Model Add-on. Options B, C, and D are correct. B: The CIM requires the installation of the Splunk Common Information Model Add-on. C: Data models defined in the CIM can be accelerated to improve search performance. D: It provides a set of standard field names and tags for different data sources. A is false: The CIM does not automatically rename all fields; it uses field aliases and tagging to map data to the standard. E is false: The CIM provides data models and field standardization, not predefined dashboards (dashboards are provided by other apps like the Splunk App for Enterprise Security).

Answer

The CIM automatically renames all fields in incoming data to match its standard

Answer

The CIM includes predefined dashboards and reports

Question 12

An admin is troubleshooting a saved search that uses the `| `my_macro` command. The macro definition is `stats count by $1$`. The saved search is scheduled to run hourly. Which of the following issues could cause the saved search to fail? (Choose three.)

Accepted Answer

The macro argument passed in the saved search contains a space without quotes. Options A, B, and D are correct. A: If the macro argument contains a space without quotes, it will be parsed incorrectly. B: If the macro definition includes a pipe at the start but the invocation also includes a pipe, the double pipe causes a syntax error. D: If the macro is not shared to the app where the saved search is stored, the saved search cannot access it. C: 'All time' time range is not a direct cause of failure. E: Overlap might cause skip but not necessarily failure.

Answer

The saved search's time range is set to 'All time'

Answer

The saved search has a cron schedule that overlaps with another saved search

Question 13

Refer to the exhibit. The macro `count_by_host` is defined as shown. The macro is invoked as `| `count_by_host`. What will the expanded search look like?

Accepted Answer

`| | stats count by host, sourcetype`. Since the macro definition includes a leading pipe, invoking it with `| `count_by_host` results in two pipes – one from the invocation and one from the definition. So the expanded search becomes `| | stats count by host, sourcetype`. Option A would be missing the second pipe, option B shows the macro invocation unexpanded, and option C would be missing both pipes.

Answer

`| stats count by host, sourcetype`

Answer

`| `count_by_host`

Answer

`stats count by host, sourcetype`

Question 14

Refer to the exhibit. An admin configures acceleration for the Network_Traffic data model as shown. A user runs a search using the data model over the last 60 days. Why might the search be slower for data older than 7 days?

Accepted Answer

The earliest_time is set to -7d@d, so the acceleration index only covers the last 7 days. The `earliest_time` parameter in the acceleration configuration is set to -7d@d, meaning the acceleration summary is built only for data from the last 7 days. Searches querying older data must scan raw events, which is slower. Option A is incorrect because summary_range controls how long to keep accelerated data, not the time range covered. Option B misstates the summary_range: it is set to 30d, not that data within 30 days is accelerated. Option D is incorrect; the datamodel command is not required to use acceleration; acceleration is transparently applied when using the data model.

Answer

The data model is not compatible with acceleration

Answer

The summary_range is set to 30d, so only data within 30 days is accelerated

Answer

The search must use the `| datamodel` command to benefit from acceleration

Question 15

Refer to the exhibit. A search uses the macro as `| `fillnull(field=user)`. However, the search fails with a syntax error. What is the most likely issue?

Accepted Answer

The macro definition contains unescaped commas. In macro definitions, commas that are part of the code need to be escaped with a backslash because commas are used to separate macro arguments. The `if` function in the macro definition uses commas, and they are not escaped, so the macro expansion is broken. Option A is incorrect; the invocation with `field=` is a valid way to pass named arguments. Option C is incorrect; named arguments are allowed and not the issue. Option D is incorrect; a leading pipe is not needed inside the macro definition because the invocation already provides a pipe before the macro name.

Answer

The macro argument should be passed without the `field=` prefix

Answer

The macro definition should use positional arguments instead of named

Answer

The macro definition should include a pipe before `eval`