SPLK-1003 Macros, Saved Searches and CIM Practice Test 4 — 15 Questions

Question 1

A large enterprise uses multiple Splunk search heads. An admin wants to create a saved search that automatically runs on all search heads and sends a single alert email per triggered result, not per search head. Which saved search setting should be configured?

Accepted Answer

Set Alert Type to 'Per Result' to trigger an alert for each matching event.. Option B is correct because 'Per Result' alerting ensures each result triggers an alert action, but the challenge is to have one email per result across search heads. Actually, in a multi-search head environment, saved searches run independently. To deduplicate, you'd need to use summary indexing or a central index. However, the question asks for the setting to achieve single email per result: the best is to set alert type to 'Per Result' and then use 'Throttle' to limit to one email per result. But among options, 'Per Result' is key. Option A is for scheduling. Option C suppresses consecutive identical alerts. Option D is for time range.

Answer

Set the time range to 'Real-time' to capture events as they happen.

Answer

Enable 'Alert Suppression' to suppress duplicate alerts.

Answer

Set the Schedule to 'Continuous' to avoid duplicates.

Question 2

A team needs to create a saved search that runs automatically every Monday at 8 AM and emails a CSV file of the results. Besides configuring the search string, which steps are required?

Accepted Answer

Set a schedule (Cron: 0 8 * * 1) and add an email alert action with attachment format CSV.. Option B is correct because a saved search must have both a schedule and at least one alert action (like email with CSV attachment). Option A is incorrect because the schedule time can be set directly. Option C is incorrect because CSV output is configured in the alert action. Option D is incorrect because summary indexing is optional.

Answer

Create a dashboard panel that runs the search on schedule and sends email.

Answer

Set the search to 'Summary Index' and run a separate alert on the summary.

Answer

Define the schedule and set the time range to 'Last 7 days'.

Question 3

An admin notices that a saved search with a scheduled alert is not triggering as expected even though the search returns results. The search uses a macro with arguments. Which troubleshooting step should the admin take first?

Accepted Answer

Review the macro definition for syntax errors, such as missing brackets or incorrect argument references.. Option C is correct because the most common issue with macros is the definition syntax. Option A is not first step. Option B is not relevant if macro is defined. Option D is too narrow.

Answer

Ensure that the macro name does not conflict with existing commands or other macros.

Answer

Verify the macro's permissions are set to global.

Answer

Check the search head's job inspector for the expanded search string.

Question 4

A Splunk admin wants to create a saved search that triggers an alert when the average CPU usage across all servers exceeds 80% over a 5-minute window. The data is in a 'perfmon' sourcetype. Which search best fits this requirement?

Accepted Answer

index=os sourcetype=perfmon counter="% Processor Time" earliest=-5m latest=now | bucket _time span=5m | stats avg(Value) as avg_cpu by host | where avg_cpu > 80. Option A is correct because it accurately defines the requirements using events per second to ensure each server window, correct time command bucket, and stats to compute average. Option B does not use latest properly. Option C uses streamstats which is not necessary. Option D uses timechart which creates multiple series.

Answer

index=os sourcetype=perfmon counter="% Processor Time" | timechart avg(Value) as avg_cpu by host | where avg_cpu > 80

Answer

index=os sourcetype=perfmon counter="% Processor Time" earliest=-5m latest=now | stats avg(Value) as avg_cpu by host | where avg_cpu > 80

Answer

index=os sourcetype=perfmon counter="% Processor Time" | streamstats avg(Value) as avg_cpu by host | where avg_cpu > 80

Question 5

Which TWO benefits does the Splunk Common Information Model (CIM) provide? (Choose two.)

Accepted Answer

Provides a consistent field naming convention across different data sources.. Options A and D are correct. CIM normalizes data to common fields (making it easier to search across sourcetypes) and provides acceleration through data models. Option B is wrong because CIM does not define sourcetypes; sourcetypes are input-level. Option C is wrong because CIM does not provide real-time correlation directly; it standardizes fields. Option E is wrong because CIM applies to all indexes, not just summary.

Answer

Enables real-time correlation of events across multiple data sources.

Answer

Reduces indexing volume by summarizing data into CIM-compliant indexes.

Answer

Defines the sourcetypes for common technologies (e.g., firewall, IDS).

Question 6

Which THREE are valid uses of macros in Splunk? (Choose three.)

Accepted Answer

Enforce security by hiding sensitive parts of the search from users.. Options B, C, and D are correct. Macros can encapsulate complex SPL, accept arguments, and be used to enforce security policies by restricting access to parts of searches. Option A is wrong because macros cannot dynamically change the index at search time (they can, but not as a primary purpose; it's discouraged due to performance). Option E is wrong because macros are not designed to modify search results; they generate SPL that runs against events.

Answer

Dynamically switch between different indexes at search time based on user input.

Answer

Modify the results of a search after the search completes (post-processing).

Question 7

Which TWO are correct about saved search permissions and scheduling? (Choose two.)

Accepted Answer

A saved search's permissions can be set to 'global' so that any user can run it.. Options B and D are correct. Saved searches inherit owner permissions, and scheduling requires the 'schedule_search' capability. Option A is wrong because the default is 'private' for owner. Option C is wrong because only users with schedule capability can set schedules. Option E is wrong because saving a report inherits the user's permissions, not app-wide.

Answer

Any user can schedule a saved search regardless of role.

Answer

A saved search that is a report automatically inherits the app's default permissions.

Answer

All saved searches are visible to everyone in the app by default.

Question 8

The admin calls the macro as shown. What will be the expanded search string?

Accepted Answer

search index=main earliest=-1h latest=now | stats count by sourcetype | rename count as total. Option A is correct because macro arguments are substituted: $index$ becomes 'main', $time_range$ becomes '-1h'. The brackets define the search inside. Option B incorrectly concatenates. Option C uses single quotes. Option D swaps order.

Answer

search index='main' earliest='-1h' latest=now | stats count by sourcetype | rename count as total

Answer

search index=-1h earliest=main latest=now | stats count by sourcetype | rename count as total

Answer

search index=main|earliest=-1h latest=now | stats count by sourcetype | rename count as total

Question 9

What is the most likely reason for this behavior?

Accepted Answer

The 'max_time' setting limits the accelerated data to the last 1 day, so tstats only queries that time range.. Option C is correct because the acceleration is enabled with 'max_time' set to 1 day, meaning the accelerated summaries only cover the last 24 hours. The 'earliest_time' of -7d sets the range for the initial data model but not the acceleration. Option A is incorrect because the summaries are defined for 5m and 1h. Option B is incorrect because 'enabled' is true. Option D is incorrect because a 1-day acceleration limit is not 'never outdated'.

Answer

The acceleration summaries are only generated at the 5-minute and 1-hour intervals, not daily.

Answer

The acceleration is disabled because 'enabled' is set to true incorrectly.

Answer

The acceleration automatically becomes outdated after 1 day and requires a rebuild.

Question 10

What is the most likely cause of this error?

Accepted Answer

The endpoint "/services/authentication/users" is incorrect; it should be "/services/authentication/users". Actually the correct endpoint is '/services/authentication/users' but the admin might have a typo.. Option B is correct because the '| rest' command requires the endpoint path, but the macro definition includes a space before the pipe, which can be parsed incorrectly. Additionally, the leading pipe inside the macro definition is generally not recommended; the macro should start without the pipe. However, the specific error is about URL not found, which suggests the endpoint path is wrong. Option A is a possible cause but less direct. Option C is incorrect because braces are not needed. Option D is incorrect because permissions are not the error.

Answer

The macro does not have read permissions for the administrator's role.

Answer

The macro is missing the '|' pipe in front of the rest command.

Answer

The macro definition should use curly braces {} instead of brackets [].

Question 11

A Splunk administrator wants to create a reusable search component that accepts a sourcetype and a time range. What is the correct method to define this in Splunk?

Accepted Answer

Define a macro with arguments using backticks and $arg$ syntax.. Macros are the correct way to define reusable search components with arguments. They use backtick syntax and $arg$ placeholders. Option B is correct because macros are designed for this purpose. Option A (saved search with tokens) is for dashboards, not reusable search fragments. Option C (eval statement) does not create reusable search components. Option D (lookup definition) is for lookup tables, not search logic.

Answer

Create a saved search that uses tokens to parameterize the query.

Answer

Use an eval statement to define a variable that holds the query.

Answer

Use a lookup definition with parameters to filter results.

Question 12

A user reports that a macro named `my_macro` is not expanding in a search. The macro is defined in a private app called 'App_A'. The user is running the search in a different app called 'App_B'. What is the most likely cause of the issue?

Accepted Answer

The macro is not shared to the global context.. Macros are confined to the app where they are defined unless shared to the global context. If the macro is not shared, it will not be accessible from other apps. Option B is correct. Option A (syntax error) would cause a different error. Option C (permissions) is related but the primary issue is app context. Option D (case sensitivity) is not relevant as Splunk macro names are case-insensitive.

Answer

The macro has a syntax error that prevents expansion.

Answer

The user does not have permission to view the macro.

Answer

The macro name is case-sensitive and the user used wrong case.

Question 13

A user defined a macro that includes a lookup command. The macro works correctly in ad-hoc searches. However, when the macro is used in a scheduled saved search, the macro fails to expand. Administration confirms the macro is shared globally. What is the most likely cause of this failure?

Accepted Answer

The lookup used in the macro is not accessible in the saved search's app context.. Scheduled saved searches run under the context of the search user (owner) and the app where the saved search is defined. If the macro uses a lookup that is not accessible in that app context (e.g., the lookup is defined in a different app and not shared), the macro will fail at schedule time even though the macro itself is global. Option C is correct. Option A (syntax error) would also fail ad-hoc. Option B (macro not global) is false as stated. Option D (macro arguments) is unlikely unless mismatch.

Answer

The macro expects arguments that are not provided in the saved search.

Answer

The macro is not shared to the global context despite confirmation.

Answer

The macro contains a syntax error that only appears at schedule time.

Question 14

Which Common Information Model (CIM) data model is appropriate for standardizing authentication events?

Accepted Answer

Authentication. The CIM includes the 'Authentication' data model for authentication events. Option A is correct. Option B (Change Analysis) is for configuration changes. Option C (Endpoint) is for operating system events. Option D (Network Traffic) is for network sessions.

Answer

Change Analysis

Answer

Network Traffic

Answer

Endpoint

Question 15

A Splunk administrator needs to schedule a saved search to run every second Friday at 10:00 AM. Which cron expression should be used?

Accepted Answer

0 10 8-14 * 5. The cron expression for 'every second Friday at 10:00 AM' is '0 10 * * 5' (every Friday at 10:00), but to run only on the second Friday, a combination with day-of-month is needed. The correct approach is to use '0 10 8-14 * 5' to run on Fridays between 8th and 14th (the second Friday typically falls in that range). Option C is correct. Option A runs daily. Option B runs every Friday. Option D runs every second day.

Answer

0 10 * * 5

Answer

0 10 */2 * *

Answer

0 10 * * *