SPLK-1002 Macros, Saved Searches and CIM Practice Test 5 — 15 Questions

Question 1

Which TWO of the following are valid ways to define arguments in a Splunk macro?

Accepted Answer

In the macro definition, use $arg1$, $arg2$ as placeholders for the arguments.. Splunk macros use named placeholders like $arg1$, $arg2$ in the macro definition to represent arguments. When the macro is invoked, these placeholders are replaced with the actual values passed by the user, allowing flexible and reusable search snippets.

Answer

In the macro definition, use $1$, $2$ as positional placeholders.

Answer

Arguments are automatically inferred from the search string in the macro definition.

Answer

In the macro definition, use named placeholders like $error_code$.

Question 2

Refer to the exhibit. An analyst executes the following search: `| filter_status(status_code=500)`. What will be the result?

Accepted Answer

The macro will fail because named arguments are not supported; Splunk macro arguments are positional.. The macro `filter_status` is defined with positional arguments (e.g., `$arg1$`), but the call `filter_status(status_code=500)` uses named argument syntax (`name=value`). Splunk macros only support named arguments if they are explicitly defined with `args = =` in the macro definition. Since this macro does not have such a definition, the named argument is not recognized, causing the macro to fail. The error occurs because Splunk cannot map `status_code=500` to the positional placeholder `$arg1$`.

Answer

The macro will run successfully, but it will use the literal string "status_code=500" as the argument value.

Answer

The macro will fail because the argument definition uses $arg1$ but the macro was called with "status_code=500".

Answer

The macro will run successfully, returning count of events with status=500.

Question 3

GlobalTech runs Splunk Enterprise Security with CIM compliance. Their security operations center uses a scheduled saved search named 'Brute Force Detection' that runs every 30 minutes. The search definition is: `| tstats count from datamodel=Authentication where Authentication.action=failure by Authentication.user, Authentication.src | where count > 5 | join type=outer user [search index=* sourcetype=linux_secure | stats count by user | where count > 5]`. This search has been working for months. Recently, after an upgrade to the Splunk environment, the saved search started returning no results. The administrator checks the search log and sees that the tstats portion runs fine but the secondary search (the subsearch) returns no events even though there are matching events in the index. The subsearch uses a macro named 'get_failed_users' defined as `search index=* sourcetype=linux_secure "Failed password" | stats count by user | where count>5` with no arguments. The administrator confirms that the macro's search works when run manually in the same time range. What is the most likely reason the subsearch returns no results?

Accepted Answer

The macro 'get_failed_users' is not defined in the same app context as the saved search.. Macros are resolved in the context of the app where the saved search is defined. If the macro 'get_failed_users' is not defined in the same app context as the 'Brute Force Detection' saved search, the subsearch will fail to resolve the macro and return no results, even though the macro works when run manually in a different app context. Splunk's macro resolution depends on the app context of the search, not the user's current app.

Answer

The subsearch is not part of the data model acceleration and is limited by the time range of the main search.

Answer

The subsearch uses a macro, and macros cannot be used in subsearches.

Answer

The macro definition has a typo in the search command.

Question 4

A Splunk administrator is normalizing web proxy events into the CIM. The raw events contain a field named `clientip` that holds the client address, but the Web data model's `Web` dataset expects the field `src`. The administrator wants searches against the data model to return these events without modifying the raw data. Which approach should be used?

Accepted Answer

Create a field alias that maps `clientip` to `src` on the relevant sourcetype, then accelerate the data model.. The CIM data models rely on standardized field names such as `src`, so proxy events carrying `clientip` must be mapped to that name for the Web dataset to include them. A field alias applied to the sourcetype performs this mapping at search time, leaving raw data intact while allowing the accelerated data model to populate correctly.

Answer

Reindex the proxy data after adding a `TRANSFORMS` stanza that writes the `clientip` value into a new `src` field.

Answer

Add a calculated field in the data model that copies the value of `clientip` into `src` at index time.

Answer

Rename the `clientip` field to `src` by editing the `props.conf` `FIELDALIAS` setting and restarting the indexers.

Question 5

A security team wants to reuse a complex search across multiple saved searches and dashboards. They create a macro named `failed_logins` with the definition `index=security sourcetype=linux_secure "Failed password" | stats count by src_ip`. When they invoke the macro in a search as `| `failed_logins``, the search returns no results. What is the most likely reason?

Accepted Answer

The macro definition should not include a leading pipe character before the first command.. A macro definition should be a search fragment that can be inserted into a larger search. If the definition starts with a search command like `index=security`, it should not begin with a pipe; the pipe is added at invocation time. The other options describe common misconceptions about macro arguments, invocation syntax, and command restrictions.

Answer

The macro definition contains a search command that cannot be used within a macro.

Answer

The macro invocation syntax is incorrect; it should be `failed_logins` without a leading pipe.

Answer

The macro must be defined with an argument placeholder, even if it takes no arguments.

Question 6

A Splunk power user creates a saved search that runs every hour and sends an email alert if the number of events containing the word 'error' exceeds 50. After deployment, users report receiving duplicate email alerts for the same time period. The saved search is configured with a cron schedule of '0 * * * *' and a time range of 'Last 60 minutes'. Which of the following is the most likely cause of the duplicate alerts?

Accepted Answer

The saved search is scheduled to run at the same time as another identical saved search, causing duplicate alerts.. Duplicate alerts for the same time period often occur when multiple saved searches with identical logic and schedules are active. Even if the search itself is correct, another search could be generating the same alerts. Checking for duplicate saved searches is a key troubleshooting step. The other options describe issues that would cause multiple alerts for different results or within the same run, but not necessarily duplicates for the same period.

Answer

The alert is set to trigger for each result, and the search returns multiple results, causing multiple alerts.

Answer

The saved search is configured to run in real-time mode, causing overlapping results.

Answer

The alert's throttle settings are not configured, allowing the same alert to trigger multiple times within the throttle window.

Question 7

A Splunk Power User needs to create a macro that filters events based on a field value passed at search time. The macro must be usable in any app within the Splunk instance. The user has permission to create knowledge objects only in their own app context. Which action should the user take to create the macro with the required scope?

Accepted Answer

Create the macro in the user's app and set the 'Sharing' to 'Global' so it is available in all apps.. To make a macro available in all apps, the macro must be shared globally. A Power User can create the macro in their own app and then set its sharing permissions to Global, which extends its availability to all apps in the Splunk instance. This leverages the user's existing permissions without requiring admin access to other apps.

Answer

Create the macro in the user's app and set the 'Sharing' to 'Private' so it is available only to the user.

Answer

Create the macro in the user's app and set the 'Sharing' to 'App' so it is available only within that app.

Answer

Create the macro in the search app and set the 'Sharing' to 'App' so it is available only within the search app.

Question 8

A Splunk Power User is asked to create a macro that will be used by several saved searches. The macro must accept a host name as an argument and count events for that host. The macro definition is: `index=main host=$host$ | stats count`. When the macro is invoked as `` `count_host(myserver)` ``, the search fails with an error. What is the most likely cause?

Accepted Answer

The macro argument value must be enclosed in double quotes when the macro is invoked.. The macro definition uses `host=$host$` without quotes around the argument placeholder. When the macro is invoked with an unquoted argument like `myserver`, the expanded search becomes `host=myserver`, which Splunk interprets as a field named `myserver` rather than a string value. To fix this, the argument must be passed with quotes, e.g., `"myserver"`, or the macro definition should include quotes around `$host$`. This ensures the value is treated as a string literal.

Answer

The macro argument is not enclosed in single quotes in the definition.

Answer

The macro argument `$host$` was not defined when the macro was created.

Answer

The macro was invoked with parentheses instead of backticks.

Question 9

A Power User is building a dashboard panel that must count events from a data model named `Authentication` in the `CIM` app. The user wants the search to use the data model rather than the raw index and needs results to populate quickly. Which command should the search use?

Accepted Answer

`| from datamodel:"Authentication" | stats count by user`. The from command retrieves data from a named data model, and if that data model is accelerated the results are served from the accelerated summaries, which is what makes dashboard panels populate quickly. Aggregation is then applied with a normal stats command over the returned fields. The datamodel command is for inspection, tstats uses different syntax without a from keyword, and pivot is tool-generated rather than hand-written.

Answer

`| datamodel Authentication Authentication search`

Answer

`| pivot Authentication count by user`

Answer

`| tstats count from datamodel=Authentication by Authentication.user`

Question 10

A Splunk administrator needs to create a saved search that runs every day at 6 AM and sends an email with the results to the security team. The search should also be available for other users to run manually from the Search & Reporting app. Which configuration should the administrator use?

Accepted Answer

Create a scheduled report with a cron schedule of '0 6 * * *' and enable email delivery.. A scheduled report is the correct choice because it can be scheduled to run daily at 6 AM and email results, while also being available in the Search & Reporting app for manual execution. Alerts require a trigger condition and are not ideal for simply sending results. Real-time alerts run continuously. Dashboards do not provide a saved search for manual execution.

Answer

Create a real-time alert that triggers when new events are indexed and sends email.

Answer

Create a dashboard with a time range picker and schedule a PDF export daily at 6 AM.

Answer

Create a scheduled alert with a cron schedule of '0 6 * * *' and configure email notification.

Question 11

A Splunk administrator needs to create a saved search that runs every hour and sends an email to the security team if any new critical events appear. The administrator wants to ensure the email includes a link to the search results. Which setting must be configured in the saved search?

Accepted Answer

Enable the 'Send Email' alert action and configure the email recipients.. A saved search alert that sends email requires the 'Send Email' alert action to be enabled and recipients configured. Scheduling ensures it runs hourly, but without the email action no email is sent. The other options include unnecessary or incorrect settings that do not fulfill the core requirement.

Answer

Add the 'Send Email' action and set the search to run on a cron schedule.

Answer

Set the search to run in real-time and enable the 'Email' action.

Answer

Configure the search to use the 'Send Email' action and set the time range to 'All time'.

Question 12

A Splunk administrator needs to create a saved search that runs daily at 2 AM and sends an email with the results to the security team. The search should summarize the number of events per sourcetype for the previous day. Which of the following is the correct sequence of steps to accomplish this?

Accepted Answer

Run the search, then click Save As > Report, set the schedule to daily at 2 AM, and configure an email alert action with the security team's address.. Saving the search as a report and configuring a scheduled email alert is the standard method to achieve daily email delivery of search results. The built-in email action in Splunk simplifies this process, and setting the schedule to daily at 2 AM meets the timing requirement.

Answer

Run the search, then click Save As > Report, set the schedule to daily at 2 AM, and add a script action to send the results via email.

Answer

Run the search, then click Save As > Dashboard Panel, add the panel to a new dashboard, and configure a scheduled PDF delivery to the security team.

Answer

Run the search, then click Save As > Alert, set the alert type to Scheduled, set the cron schedule to '0 2 * * *', and add an email action with the security team's address.

Question 13

A Splunk Power User has created a macro named `get_errors` that filters events to show only errors from the `web` index. The macro definition is `index=web error`. When a user runs the search `| `get_errors``, they receive an error: "Invalid macro name". What is the most likely cause?

Accepted Answer

The macro is being invoked without a leading pipe (`|`) and without a search command, so Splunk treats it as a search term rather than a macro.. When a macro contains a search command such as `index=web error`, it must be invoked with a leading pipe and within a search that already has a generating command. Simply running `| `get_errors`` without an initial search command causes Splunk to treat the macro name as a search term, resulting in "Invalid macro name". The correct usage is `index=web | `get_errors`` or to define the macro to include a leading search command.

Answer

The macro was not shared globally and is therefore not accessible to the user.

Answer

The macro name contains an underscore, which is not allowed in macro names.

Answer

The macro definition uses the `index` keyword, which is not allowed inside a macro.

Question 14

A Splunk administrator is troubleshooting a macro that fails when used in a scheduled search but works in ad-hoc searches. The macro definition includes a subsearch that references an index. The error message in the scheduled search log indicates 'Invalid search command: `my_macro`'. The macro is shared globally. Which of the following is the most likely cause of the failure?

Accepted Answer

The macro name is not prefixed with a backtick (`) in the scheduled search definition, causing Splunk to treat it as a regular search command.. The error 'Invalid search command' strongly suggests that the macro is not being recognized as a macro, which happens if the backtick syntax is omitted. Even if the macro is correctly defined and shared, Splunk will not expand it without the backticks. Other options, such as permissions or subsearch restrictions, would produce different errors. Therefore, checking the search syntax for proper backtick usage is the first troubleshooting step.

Answer

The macro contains a subsearch that is not permitted in scheduled searches due to performance constraints.

Answer

The user running the scheduled search does not have permissions to access the index referenced in the macro's subsearch.

Answer

The macro is not available in the app context of the scheduled search because it is shared globally but the app does not have permission to use it.

Question 15

A Splunk administrator is configuring a saved search that must run every hour and generate a CSV file containing the results, which will be picked up by an external system. The admin wants to ensure the saved search does not trigger an alert but still produces the file. Which configuration should the admin use?

Accepted Answer

Set the saved search to run on a cron schedule and configure the 'Output results to a CSV file' option in the saved search's output settings.. A scheduled saved search can be configured to output results to a CSV file without enabling alerting. The correct approach is to set the schedule and then use the output settings to specify CSV output. This produces the file as required and avoids any alert triggers, which aligns with the administrator's goal.

Answer

Set the saved search to run on a cron schedule and configure the 'Output results to a CSV file' option in the alert actions.

Answer

Set the saved search to run on a cron schedule and enable the 'Schedule' option, then use a scripted input to export the results to CSV.

Answer

Set the saved search to run on a cron schedule and enable the 'Alert' option with a trigger condition of 'Number of Results > 0'.