SPLK-1002 Macros, Saved Searches and CIM Practice Test 4 — 15 Questions

Question 1

An analyst creates a macro that uses `| inputlookup` to validate a macro argument. Which statement about macro validation is true?

Accepted Answer

The macro can use `| inputlookup` to define a list of valid values for an argument.. Splunk macros can include validation logic using commands like `| inputlookup` to check if an argument value exists in a lookup table. This allows the macro to define a list of valid values for an argument, effectively validating it. Therefore, statement B is true.

Answer

Macro validation is not possible; arguments are always trusted.

Answer

Macro validation must be implemented in the saved search that uses the macro.

Answer

Macro arguments can be validated using regular expressions inside the definition.

Question 2

A performance analyst notices that a saved search running a macro with multiple `| eval` statements takes significantly longer than expected. The macro includes conditions like `| eval status=if(success=="true", "OK", "Fail")`. Which change would most likely improve performance?

Accepted Answer

Replace the `| eval` with a lookup table that maps the conditions.. Replacing conditional `| eval` statements with a lookup table moves the mapping logic out of the search pipeline and into a pre-built knowledge object, which Splunk can apply more efficiently than evaluating if/else logic per event. Lookups are optimized for field-value matching and avoid the CPU overhead of repeated eval expressions across large result sets. This is a standard Splunk performance tuning technique when eval logic is static and reusable.

Answer

Reduce the number of arguments passed to the macro.

Answer

Increase the summary index range to reduce the number of events processed.

Answer

Add more `| fields` commands to limit output fields.

Question 3

Which THREE of the following are valid ways to define macro arguments in Splunk? (Select exactly 2.)

Accepted Answer

Defining arguments list in `args` field: `args = arg1, arg2`. In Splunk, macro arguments can be defined in several ways. Option C is correct: listing arguments in the `args` field (e.g., `args = arg1, arg2`) defines named arguments that can be referenced as `$arg1$`, `$arg2$`. Option D is correct: using `$arg$=default$` syntax defines a named argument with a default value. Option E is correct: using positional numeric arguments like `$1$`, `$2$` also defines macro arguments, referenced by position. Option A is incorrect because `$arg$` without a default value is not a valid definition; a default must be provided. Option B is incorrect because `eval` is not used to define arguments; arguments are defined in the macro definition itself.

Answer

`$arg$` without default

Answer

Using `| eval` to set argument values inside the macro

Question 4

Which THREE of the following are true considerations when using CIM data model acceleration? (Select exactly 3.)

Accepted Answer

When acceleration is built, searches using the data model may use the `tstats` command for faster retrieval.. Option B is correct because once a data model's acceleration is built, Splunk can satisfy searches against that data model using the tstats command, which reads precomputed results from the acceleration summaries instead of scanning raw events, delivering much faster retrieval. Option C is correct because data model acceleration is not automatic; an administrator must explicitly enable acceleration on the data model (via Settings > Data Models or the acceleration setting) before any summaries are built. Option D is correct because enabling acceleration requires configuring a summary range, which defines how far back in time the acceleration summaries cover and thus how much historical data is accelerated. Option A is incorrect because acceleration is not limited to indexed fields; both indexed and extracted fields used by the data model can be accelerated. Option E is incorrect because acceleration stores its precomputed results in TSIDX-based acceleration summary files (high-performance buckets), not in traditional summary indexes created by the collect/summary indexing feature. The final unmarked option is incorrect because acceleration does not require all constraints to be defined with field aliases.

Answer

Acceleration only works on indexed fields; extracted fields are not accelerated.

Answer

Acceleration uses summary indexes to store precomputed results.

Answer

Acceleration requires that all data model constraints be defined with field aliases.

Question 5

Which TWO best practices should be followed when creating saved searches that use macros? (Select exactly 2.)

Accepted Answer

Escape special characters in macro arguments to ensure correct parsing.. Option C is correct because macro arguments are substituted textually into the search string, so any special characters (such as quotes, backslashes, or search operators) in the argument values must be properly escaped to prevent parsing errors or unintended search behavior. Option E is correct because subsearches inside macros run for every invocation and can severely degrade search performance, so best practice is to avoid embedding subsearches in macros and instead use alternatives like lookups or scheduled searches. Option A is not a best practice because macros should be scoped appropriately (often to a specific app) rather than always defined globally, which can cause naming collisions and unintended reuse. Option B is incorrect because macros should generally use relative time ranges or accept time as an argument, since static time ranges produce stale results. Option D is not among the selected best practices for this scenario, as inline comments are not a standard or required practice for macro definitions in this context.

Answer

Define macros globally so they are accessible by all saved searches.

Answer

Use static time ranges in macros to avoid unexpected time shifts.

Answer

Include inline comments in macro definitions to document the logic.

Question 6

A large organization uses Splunk to monitor its network infrastructure. They have a single saved search that runs every hour to create a summary index for each of the 50 network device sourcetypes. The saved search uses a macro named `build_network_summary` that accepts two arguments: `sourcetype` and `time_range`. The macro definition is:

```
[build_network_summary]
definition = index=network sourcetype=$sourcetype$ earliest=$time_range$ latest=now | stats count by src_ip, dest_ip, protocol | collect index=network_summary
args = sourcetype, time_range
iseval = 0
```

The saved search iterates over the 50 sourcetypes using a separate lookup or list. Recently, the security team noticed that the network_summary index is missing data for certain sourcetypes, specifically those with hyphens in their names (e.g., `cisco-asa`, `juniper-srx`). For other sourcetypes, the summary is complete. The saved search runs without errors in Splunk's job inspector. Which course of action should the administrator take to resolve the issue?

Accepted Answer

Modify the macro definition to enclose the `$sourcetype$` argument in quotation marks: `sourcetype="$sourcetype$"`. Sourcetype values containing hyphens (e.g., cisco-asa) are interpreted by the Splunk search parser as a subtraction expression when substituted unquoted into the macro, so the search silently returns no results for those sourcetypes. Wrapping the argument in double quotes forces the value to be treated as a literal string. This is why the job inspector shows no errors but data is missing for hyphenated sourcetypes.

Answer

Increase the summary index range to cover all sourcetypes in one pass rather than iterating.

Answer

Change the macro's time_range argument to use a static time range to avoid relative time issues.

Answer

Enable acceleration on the network_summary index to improve data completeness.

Question 7

An engineer wants to create a saved search that runs every hour and searches against 90 days of data. To optimize performance, they should...

Accepted Answer

Use a summary index to pre-compute results.. To optimize a saved search that runs every hour against 90 days of data, using a summary index is the best choice. Summary indexing pre-computes aggregated results and stores them in an index, which can be quickly retrieved each hour without re-scanning the full 90 days. Report acceleration (option D) also pre-computes results but is less efficient for such a large time range because it must maintain acceleration over 90 days. Option B (relative time range) is already implicit in the search. Option C (| stats with span) is a search technique and does not inherently optimize performance for repeated searches.

Answer

Set a time range relative to the search time.

Answer

Use the `| stats` command with `span` to aggregate.

Answer

Enable report acceleration on the saved search.

Question 8

A security analyst is trying to normalize authentication data from multiple sources using CIM. After mapping sourcetypes to the Authentication data model, the CIM acceleration dashboard shows no data. The data model acceleration is enabled and has completed building. What is the most likely cause?

Accepted Answer

The field extractions for the sourcetypes do not align with CIM field names.. The CIM data model relies on field extractions that match the CIM field names exactly. If the field extractions for the sourcetypes do not align with CIM field names, the data model will not populate with data, even if acceleration is enabled and completed. Tags (option B) are not required if sourcetypes are mapped appropriately; permissions (option D) affect visibility, not data population; and acceleration being enabled (option A) is stated as true.

Answer

The data model acceleration is not enabled.

Answer

The tags for the sourcetypes are not correctly assigned to the data model.

Answer

The permissions on the data model are incorrect.

Question 9

When designing a macro for use across multiple dashboards, which two considerations are important? (Choose TWO.)

Accepted Answer

Use token arguments to parameterize the macro.. Option A is correct because token arguments (for example, a macro defined as `my_macro($field$)` and invoked with `my_macro(user)` or `my_macro(host)`) let the same macro operate on different fields or values across dashboards, which is essential for reuse. Option C is correct because a macro shared across multiple dashboards must be usable by every role that views those dashboards; granting appropriate global permissions (or otherwise ensuring the required roles can execute the macro) prevents permission errors when the macro is invoked in different contexts. Option B is not appropriate because hard-coding absolute time ranges makes the macro rigid and breaks when dashboards use different time pickers or relative ranges. Option D is good practice for documentation but is not one of the two key design considerations for cross-dashboard reuse. Option E is not a general requirement, since macros can legitimately contain subsearches when the use case demands it.

Answer

Include absolute time ranges in the macro definition.

Answer

Define the macro with a description for documentation.

Answer

Avoid using macros with subsearches.

Question 10

A saved search that runs every hour is showing 'No results' in its history, but the same search when run manually returns results. Which two of the following are likely causes? (Choose TWO.)

Accepted Answer

The index being searched is not available at the scheduled time.. Option E is correct because a scheduled saved search has its own time range (often a relative range like 'Last 1 hour' evaluated at run time), and if that differs from the range used in the manual run, the scheduled execution can legitimately return no results while the manual run returns data. Option D is correct because if the target index is unavailable, closed, or not receiving data at the scheduled time (e.g., indexing delay, indexer downtime, or a forwarder outage), the hourly run finds nothing even though the index has data when the search is run manually later. Option A is not a likely cause because outdated acceleration affects summary/acceleration performance and coverage, not a complete 'No results' outcome for a search that works manually. Option B is not a likely cause because a deleted owner typically affects ownership, permissions, and scheduling behavior rather than silently producing empty results while the same search works manually. Option C is not a likely cause because a macro typo would also break the manual run, so it cannot explain results appearing only when run by hand.

Answer

The saved search's acceleration is outdated.

Answer

The user who created the saved search has been deleted.

Answer

The saved search uses a macro that has a typo in its definition.

Question 11

A company has over 2000 saved searches that are used across multiple teams. Each team has its own app, and many searches share common logic, such as filtering by a specific index or time range. The system is experiencing slow search performance and difficulty in managing changes. The administrator wants to improve maintainability and performance. Which action would best address these issues?

Accepted Answer

Create macros for common search fragments and update saved searches to use them.. Macros in Splunk are reusable search fragments that can be defined once and referenced across many saved searches, so updating common logic (e.g., index filters or time ranges) requires changing only the macro definition rather than editing 2000 saved searches. This directly improves maintainability and reduces search-time overhead by eliminating duplicated logic. The other options address symptoms (memory, acceleration, consolidation) rather than the root cause of duplicated, hard-to-maintain search logic.

Answer

Increase the search head's memory allocation.

Answer

Enable acceleration on all saved searches.

Answer

Consolidate all saved searches into a single app and use role-based access.

Question 12

An organization has implemented the Splunk Common Information Model (CIM) for their security data. They have mapped several sourcetypes to the Authentication data model and enabled data model acceleration. However, the CIM dashboard shows no data even though searches against the raw data return results. The admin checks the data model acceleration settings and sees that the acceleration is enabled and has completed building. What is the most likely issue?

Accepted Answer

The field extractions for the sourcetypes do not align with CIM field names.. The Splunk Common Information Model (CIM) relies on field name alignment between the data and the CIM data model. If the field extractions for the sourcetypes do not produce the exact field names expected by the Authentication data model (e.g., 'user', 'action', 'src_ip'), the data model will not populate. Option B is incorrect because data model acceleration includes all indexes by default unless explicitly excluded. Option C is incorrect because permissions affect who can see the data model, not whether it populates with data. Option D is incorrect because tags are optional when sourcetypes are mapped directly via props.conf; CIM data models can use sourcetype mapping without tags.

Answer

The index where the data is stored is not included in the data model acceleration.

Answer

The data model has not been assigned the correct permissions.

Answer

The tags for the sourcetypes are not correctly assigned to the data model.

Question 13

A Splunk admin created a macro named `filter_by_region` that takes one argument: the region code. The macro definition is: `index=main sourcetype=web region=$region$`. When a user runs the search `| `filter_by_region US`` they get no results, but when they replace the macro with the actual string `index=main sourcetype=web region=US`, they get results. What is the problem?

Accepted Answer

The macro definition does not specify an argument list.. Splunk macros that accept arguments must declare the argument list in the macro definition, e.g., `filter_by_region(1)`. Without the argument list, the macro is treated as a search string with a literal `$region$` token, so the search becomes `index=main sourcetype=web region=$region$` and returns no results because no event has region equal to the literal string `$region$`. The correct fix is to edit the macro definition to include the argument list.

Answer

The macro argument is not passed correctly because of quotation marks.

Answer

The user does not have execute permissions for the macro.

Answer

The macro uses double dollar signs incorrectly; it should be `$region$`.

Question 14

After upgrading Splunk to a new version, the Security team notices that the CIM Authentication dashboard is showing a much lower number of events than before. They verify that the data is still being indexed and that the sourcetype mappings to the Authentication data model are unchanged. The admin runs a search against the data model and sees some fields are missing. What is the most likely cause of the issue?

Accepted Answer

The data model acceleration needed to be rebuilt after the upgrade.. The most likely cause is that the data model acceleration needed to be rebuilt after the upgrade. Data model acceleration creates pre-computed summaries (tsidx files) that speed up searches. After a Splunk upgrade, the acceleration may become stale or invalid, leading to incomplete results. Rebuilding the acceleration ensures that the summaries reflect the current data and field extractions.

Answer

The upgrade changed the CIM field definitions, causing some extractions to fail.

Answer

The permissions on the data model were reset during the upgrade.

Answer

The index configuration changed, and the data is now in a different index.

Question 15

A team wants to create a dashboard that displays daily user activity over the past 30 days. The underlying data is voluminous (hundreds of millions of events per day). They need the dashboard to load quickly. The admin considers two options: using a summary index with a scheduled search to pre-compute the daily counts, or using data model acceleration on a CIM data model. Which approach is most appropriate for this specific requirement?

Accepted Answer

Use a summary index because it allows custom summarization and reduces license usage.. A summary index populated by a scheduled search pre-computes the daily counts once and stores the small result set, so the dashboard reads only summarized data instead of scanning hundreds of millions of raw events. This delivers fast dashboard load times and reduces search cost. Data model acceleration is powerful but is designed for CIM-normalized datasets and interactive pivots, not necessarily for a simple daily count over a custom, high-volume dataset.

Answer

Use data model acceleration because it automatically updates and is easier to set up.

Answer

Use neither; instead, use report acceleration on the dashboard search.

Answer

Use both to ensure data availability.