SPLK-1002 Macros, Saved Searches and CIM Practice Test 4 — 15 Questions

Question 1

A Splunk admin wants to create a reusable macro that accepts a time range parameter and searches all indexes for events within that range. The macro will be used in dashboards and reports. Which macro definition is correct?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

define my_search($timerange$) [search index=* earliest=$timerange$]. Macro definitions use the format `define macro_name($arg$) [definition]`, where arguments are enclosed in dollar signs and the definition is enclosed in square brackets. Option A is incorrect because it uses `$timerange` without closing dollar sign. Option B is incorrect because it lacks the enclosing brackets. Option C is incorrect because it uses angle brackets instead of square brackets. Only option D correctly uses both the argument syntax and brackets.

Answer

define my_search($timerange) [search index=* earliest=$timerange]

Answer

define my_search($timerange$) search index=* earliest=$timerange$

Answer

define my_search($timerange$) <search index=* earliest=$timerange$>

Question 2

When creating a saved search that runs every hour and sends an email alert when the count of errors exceeds 10, which action must be configured in addition to the search logic?

Accepted Answer

Add an email alert action in the saved search settings.. Saved searches that trigger alerts require at least one alert action (e.g., email) to be defined in the saved search settings. Option B is incorrect because the `| alert` command is not used in search strings for saved search alerts. Option C is incorrect because a lookup table is not required for alerting. Option D is incorrect because summary indexing is unrelated to sending email alerts.

Answer

Include '| alert' command in the search string.

Answer

Create a lookup table to store error counts.

Answer

Enable summary indexing for the search.

Question 3

An organization uses the Splunk Common Information Model (CIM) to normalize data from various sourcetypes. After onboarding a new firewall vendor, the data is not populating the Network Traffic data model. Which of the following is the most likely cause?

Accepted Answer

The appropriate CIM tags have not been assigned to the new sourcetype.. The Splunk CIM uses tags to map sourcetypes to specific data models. Without the appropriate CIM tags (such as 'network' or 'traffic'), the data will not populate the Network Traffic data model, even if the sourcetype is included in data model acceleration or indexed into any index. Option A is incorrect because data model acceleration includes all sourcetypes unless explicitly excluded, but tagging is still required for data model population. Option C is irrelevant because custom indexes do not affect CIM mapping; tagging is the key factor. Option D is incorrect because the CIM normalizes fields via tags and field aliases—exact field name match is not required if proper tags are assigned.

Answer

The sourcetype is not included in the 'Network Traffic' data model acceleration.

Answer

The data is being indexed into a custom index that is not monitored by the data model.

Answer

The fields in the firewall data do not match the data model field names exactly.

Question 4

A Splunk administrator is asked to create a dashboard that shows the top 10 source IPs by count of failed logins over the past week. The data is already CIM-compliant and uses the Authentication data model. Which search is most appropriate?

Accepted Answer

| tstats count from datamodel=Authentication where Authentication.action=failure by Authentication.src limit 10. It uses the tstats command on the Accelerated Authentication data model, filters for Authentication.action=failure, and uses the src field (CIM-compliant source IP) with a limit of 10 to get the top source IPs by failed logins. Option B is incorrect because summaryonly=true prevents retrieval of individual event counts needed for the top 10, and the action field is not fully qualified as Authentication.action. Option C is incorrect because the datamodel command is less efficient than tstats for accelerated data models, and using top on the full dataset is resource-intensive. Option D is incorrect because it does not leverage the CIM data model acceleration and searches across all sourcetypes, which may include non-authentication data, making it less accurate.

Answer

| tstats summaryonly=true count from datamodel=Authentication where action=failure by src

Answer

| datamodel Authentication search | search action=failure | top src

Answer

| search sourcetype=* authentication action=failure | stats count by src | sort - count | head 10

Question 5

A security team has a saved search that runs every 5 minutes and looks for 'FAILED' events in Windows Security logs. The search uses a macro 'failed_logins' defined as: `define failed_logins() [search index=windows sourcetype=WinEventLog:Security EventCode=4625]`. Recently, the team noticed that the search is returning no results even though there are failed login events. What is the most likely issue?

Accepted Answer

The macro definition includes empty parentheses 'failed_logins()' but is being called without parentheses, causing Splunk to treat it as a different macro.. The macro is defined with parentheses 'failed_logins()', indicating it expects an argument, but when it is called in the saved search, it is likely called without parentheses (e.g., `failed_logins`). In Splunk, a macro defined with parentheses must be called with parentheses even if no arguments are passed; otherwise, Splunk treats it as a different macro. This causes the search to not expand the macro, leading to no results. Option B is incorrect because permissions are not the issue if it worked before. Option C is incorrect because macros can be called with a pipe, not backticks. Option D is incorrect because wildcards in sourcetype are allowed.

Answer

The macro does not have read permissions for the security team.

Answer

The macro must be called with backticks like `failed_logins` instead of pipe.

Answer

The sourcetype field is using a wildcard, which is deprecated.

Question 6

A large enterprise uses multiple Splunk search heads. An admin wants to create a saved search that automatically runs on all search heads and sends a single alert email per triggered result, not per search head. Which saved search setting should be configured?

Accepted Answer

Set Alert Type to 'Per Result' to trigger an alert for each matching event.. Setting the Alert Type to 'Per Result' ensures that an alert is triggered for each matching event in the search results. In a multi-search head environment, the saved search runs on all search heads, potentially causing duplicate alerts. However, to achieve a single alert per triggered result, you must first enable per-result alerting. Options such as throttling or using a dedicated search head can then be used to deduplicate. Option B (Alert Suppression) suppresses consecutive identical alerts from the same search, which does not address cross-head duplication. Options A and D are unrelated to the alerting mechanism. Therefore, C is the key setting among the choices.

Answer

Set the time range to 'Real-time' to capture events as they happen.

Answer

Enable 'Alert Suppression' to suppress duplicate alerts.

Answer

Set the Schedule to 'Continuous' to avoid duplicates.

Question 7

A team needs to create a saved search that runs automatically every Monday at 8 AM and emails a CSV file of the results. Besides configuring the search string, which steps are required?

Accepted Answer

Set a schedule (Cron: 0 8 * * 1) and add an email alert action with attachment format CSV.. To send a scheduled search via email with a CSV attachment, you need to set a schedule (Cron: 0 8 * * 1) and add an email alert action configured to attach the results as CSV. Option A is incorrect because dashboard panels do not send emails directly. Option B is incorrect because summary indexing is not required; you can directly schedule the search and add an alert action. Option D is incorrect because setting the time range alone does not enable email delivery.

Answer

Create a dashboard panel that runs the search on schedule and sends email.

Answer

Set the search to 'Summary Index' and run a separate alert on the summary.

Answer

Define the schedule and set the time range to 'Last 7 days'.

Question 8

An admin notices that a saved search with a scheduled alert is not triggering as expected even though the search returns results. The search uses a macro with arguments. Which troubleshooting step should the admin take first?

Accepted Answer

Review the macro definition for syntax errors, such as missing brackets or incorrect argument references.. When a saved search using a macro with arguments fails to trigger despite returning results, the admin should first review the macro definition for syntax errors (Option B). Common issues include missing brackets, incorrect argument references, or improper use of pipe characters within the macro. This is the most direct troubleshooting step because the macro may be defined incorrectly, causing the alert to fail even though the search itself returns results when run manually. Option A (name conflicts) is possible but less likely and should be checked after syntax. Option C (permissions) is irrelevant if the macro is used in a saved search that already runs. Option D (job inspector) is useful for deeper analysis but not the first step.

Answer

Ensure that the macro name does not conflict with existing commands or other macros.

Answer

Verify the macro's permissions are set to global.

Answer

Check the search head's job inspector for the expanded search string.

Question 9

A Splunk admin wants to create a saved search that triggers an alert when the average CPU usage across all servers exceeds 80% over a 5-minute window. The data is in a 'perfmon' sourcetype. Which search best fits this requirement?

Accepted Answer

index=os sourcetype=perfmon counter="% Processor Time" earliest=-5m latest=now | bucket _time span=5m | stats avg(Value) as avg_cpu by host | where avg_cpu > 80. It uses `earliest=-5m latest=now` to restrict the time range to the last 5 minutes, `bucket _time span=5m` to explicitly define the 5-minute window (even though the range is exactly 5 minutes, this ensures proper grouping for saved searches that may run later), `stats avg(Value) as avg_cpu by host` to compute the average per host within that window, and `where avg_cpu > 80` to filter hosts exceeding 80%. Option A uses `timechart`, which creates a separate series per time bucket and host, making the `where` clause ineffective (it would try to compare a field that doesn't exist). Option B omits the `bucket`, so the average is computed over the entire 5-minute range without explicit windowing, which can cause issues if the saved search runs with a different time range. Option C uses `streamstats`, which calculates a running average rather than a fixed-window average, not matching the requirement.

Answer

index=os sourcetype=perfmon counter="% Processor Time" | timechart avg(Value) as avg_cpu by host | where avg_cpu > 80

Answer

index=os sourcetype=perfmon counter="% Processor Time" earliest=-5m latest=now | stats avg(Value) as avg_cpu by host | where avg_cpu > 80

Answer

index=os sourcetype=perfmon counter="% Processor Time" | streamstats avg(Value) as avg_cpu by host | where avg_cpu > 80

Question 10

Which TWO benefits does the Splunk Common Information Model (CIM) provide? (Choose two.)

Accepted Answer

Provides a consistent field naming convention across different data sources.. The Splunk Common Information Model (CIM) provides two key benefits: (A) It normalizes data from different sources into a consistent field naming convention, making it easier to search across diverse data sources. (E) It supports data model acceleration, which speeds up searches using the tstats command on CIM-compliant data models. Option B is incorrect because real-time correlation is not a direct feature of CIM; CIM standardizes fields but does not perform correlation. Option C is incorrect because CIM does not reduce indexing volume; indexing is independent of CIM. Option D is incorrect because CIM does not define sourcetypes; sourcetypes are defined at input time.

Answer

Enables real-time correlation of events across multiple data sources.

Answer

Reduces indexing volume by summarizing data into CIM-compliant indexes.

Answer

Defines the sourcetypes for common technologies (e.g., firewall, IDS).

Question 11

Which THREE are valid uses of macros in Splunk? (Choose three.)

Accepted Answer

Enforce security by hiding sensitive parts of the search from users.. Options B, D, and E are correct. Macros can encapsulate complex SPL, accept arguments, and be used to enforce security policies by restricting access to parts of searches. Option A is incorrect because while macros can accept arguments to change the index, dynamically switching indexes is not a recommended use and is discouraged due to performance implications; it is not considered a primary valid use of macros. Option C is incorrect because macros are not designed to modify search results; they generate SPL that runs against events, not post-processing results.

Answer

Dynamically switch between different indexes at search time based on user input.

Answer

Modify the results of a search after the search completes (post-processing).

Question 12

Which TWO are correct about saved search permissions and scheduling? (Choose two.)

Accepted Answer

A saved search's permissions can be set to 'global' so that any user can run it.. Options A and D are correct. A saved search's permissions can be set to 'global' so any user can run it. When a saved search is scheduled, it runs with the permissions of the owner, not the user who views it. Option B is wrong because scheduling a saved search requires the 'schedule_search' capability, which not all users have. Option C is wrong because saved searches inherit permissions from the user who created them, not the app's default. Option E is wrong because saved searches are private to the owner by default.

Answer

Any user can schedule a saved search regardless of role.

Answer

A saved search that is a report automatically inherits the app's default permissions.

Answer

All saved searches are visible to everyone in the app by default.

Question 13

The admin calls the macro as shown. What will be the expanded search string?

Accepted Answer

search index=main earliest=-1h latest=now | stats count by sourcetype | rename count as total. Macro arguments are substituted: $index$ becomes 'main', $time_range$ becomes '-1h'. The brackets define the search inside. Option B incorrectly concatenates. Option C uses single quotes. Option D swaps order.

Answer

search index='main' earliest='-1h' latest=now | stats count by sourcetype | rename count as total

Answer

search index=-1h earliest=main latest=now | stats count by sourcetype | rename count as total

Answer

search index=main|earliest=-1h latest=now | stats count by sourcetype | rename count as total

Question 14

What is the most likely reason for this behavior?

Accepted Answer

The 'max_time' setting limits the accelerated data to the last 1 day, so tstats only queries that time range.. The 'max_time' setting in the acceleration configuration limits the accelerated data to the last 1 day. When using tstats, it only queries this accelerated time range, ignoring the 'earliest_time' of -7d in the search. Therefore, even though the search spans 7 days, tstats returns results only from the last 24 hours because the acceleration does not cover the older data.

Answer

The acceleration summaries are only generated at the 5-minute and 1-hour intervals, not daily.

Answer

The acceleration is disabled because 'enabled' is set to true incorrectly.

Answer

The acceleration automatically becomes outdated after 1 day and requires a rebuild.

Question 15

What is the most likely cause of this error?

Accepted Answer

The endpoint "/services/authentication/users" is incorrect; it should be "/services/authentication/users". Actually the correct endpoint is '/services/authentication/users' but the admin might have a typo.. The error message indicates a URL not found, which is typically caused by an incorrect REST endpoint path. Option D correctly identifies that the endpoint '/services/authentication/users' may have a typo in the macro definition. Even if the path appears correct, a subtle typo (such as an extra character or incorrect casing) would cause the REST command to fail with a 'URL not found' error. Options A, B, and C are not related to endpoint path errors.

Answer

The macro does not have read permissions for the administrator's role.

Answer

The macro is missing the '|' pipe in front of the rest command.

Answer

The macro definition should use curly braces {} instead of brackets [].