SPLK-1002 Macros, Saved Searches and CIM Practice Test 5 — 15 Questions

Question 1

A Splunk administrator wants to create a reusable search component that accepts a sourcetype and a time range. What is the correct method to define this in Splunk?

Accepted Answer

Define a macro with arguments using backticks and $arg$ syntax.. The correct method is to define a macro with arguments using backticks and $arg$ syntax (Option C). Macros are designed for reusable search components that can accept parameters. Option A (saved search with tokens) is typically used in dashboards to pass values at runtime, not for creating reusable search fragments. Option B (eval statement) defines a variable but does not create a reusable search component. Option D (lookup definition) is used for enriching events with external data, not for defining search logic.

Answer

Create a saved search that uses tokens to parameterize the query.

Answer

Use an eval statement to define a variable that holds the query.

Answer

Use a lookup definition with parameters to filter results.

Question 2

A user reports that a macro named `my_macro` is not expanding in a search. The macro is defined in a private app called 'App_A'. The user is running the search in a different app called 'App_B'. What is the most likely cause of the issue?

Accepted Answer

The macro is not shared to the global context.. Macros are confined to the app where they are defined unless they are shared to the global context. Since my_macro is defined in App_A but the user is searching from App_B, and the macro is not shared globally, it will not expand in App_B. Thus, option D is correct. Option A is incorrect because a syntax error would typically produce a specific error message, not just fail to expand. Option B is incorrect because permission to view the macro does not affect cross-app expansion; sharing to global context is required. Option C is incorrect because Splunk macro names are case-insensitive.

Answer

The macro has a syntax error that prevents expansion.

Answer

The user does not have permission to view the macro.

Answer

The macro name is case-sensitive and the user used wrong case.

Question 3

A user defined a macro that includes a lookup command. The macro works correctly in ad-hoc searches. However, when the macro is used in a scheduled saved search, the macro fails to expand. Administration confirms the macro is shared globally. What is the most likely cause of this failure?

Accepted Answer

The lookup used in the macro is not accessible in the saved search's app context.. Scheduled saved searches run under the context of the app where the saved search is defined. Even though the macro itself is shared globally, any commands or lookups used within the macro must be accessible in that app context. If the lookup used in the macro is defined in a different app and not shared to the saved search's app, the macro will fail at schedule time while working in ad-hoc searches where the user has access to the lookup. Therefore, option B is correct. Option A is unlikely because macro arguments would cause failure in ad-hoc as well. Option C is false as administration confirmed the macro is shared globally. Option D is incorrect because a syntax error would also manifest in ad-hoc searches.

Answer

The macro expects arguments that are not provided in the saved search.

Answer

The macro is not shared to the global context despite confirmation.

Answer

The macro contains a syntax error that only appears at schedule time.

Question 4

Which Common Information Model (CIM) data model is appropriate for standardizing authentication events?

Accepted Answer

Authentication. The CIM includes the 'Authentication' data model for authentication events. Option C (Authentication) is correct. Option A (Change Analysis) is for configuration changes. Option B (Network Traffic) is for network sessions. Option D (Endpoint) is for operating system events.

Answer

Change Analysis

Answer

Network Traffic

Answer

Endpoint

Question 5

A Splunk administrator needs to schedule a saved search to run every second Friday at 10:00 AM. Which cron expression should be used?

Accepted Answer

0 10 8-14 * 5. The correct cron expression for every second Friday at 10:00 AM is '0 10 8-14 * 5'. This expression runs at 10:00 AM on Fridays (day 5) only if the day of month is between 8 and 14, which includes the second Friday. Option A ('0 10 * * 5') runs every Friday at 10:00 AM, not just the second one. Option C ('0 10 */2 * *') runs at 10:00 AM every other day (every 2 days) regardless of day of week. Option D ('0 10 * * *') runs at 10:00 AM every day. Therefore, B is correct.

Answer

0 10 * * 5

Answer

0 10 */2 * *

Answer

0 10 * * *

Question 6

An administrator defines a macro that calls another macro. Both macros are defined in the same app. The first macro works correctly, but when executed, it triggers an error: 'Recursive macro call detected'. What is the most likely cause?

Accepted Answer

The second macro calls the first macro, creating a circular reference.. Splunk detects and prevents recursive macro calls (a macro that directly or indirectly calls itself). The error indicates that the two macros form a circular reference. Option B is correct. Option A (argument mismatch) would give a different error. Option C (permissions) is not relevant. Option D (syntax error) would also give a different error.

Answer

The second macro is not shared to the global context.

Answer

The first macro has a syntax error that only appears when combined.

Answer

The first macro passes incorrect arguments to the second macro.

Question 7

In the CIM, which field is commonly used to identify the user responsible for an authentication event?

Accepted Answer

user. In the CIM Authentication data model, the standard field for identifying the user responsible for an authentication event is 'user'. This field contains the username of the account involved. Option B (user) is correct. Option A (dest) typically refers to the destination endpoint. Option C (src_user) is not a standard field in the CIM Authentication data model; the source user is usually captured in the 'user' field. Option D (src) refers to the source IP address.

Answer

dest

Answer

src_user

Answer

src

Question 8

A saved search is configured to run every 5 minutes and send an alert when the count of failures exceeds 10. After several days, users report they are not receiving alerts even though failures are occurring. The saved search runs successfully and produces results. What is the most likely cause?

Accepted Answer

Alert throttling is enabled and suppressing subsequent alerts.. Alert throttling is designed to suppress duplicate alerts within a specified time period. If throttling is enabled, even though the saved search runs every 5 minutes and the condition (count of failures > 10) is met, only the first alert is sent. Subsequent alerts are suppressed until the throttle window resets, explaining why users stop receiving alerts despite ongoing failures. The search runs successfully, so permissions and alert action configuration are not the issue, and the condition is correctly set to exceed 10, not less than 10.

Answer

The saved search owner does not have permission to send alerts.

Answer

The alert action is not configured to send to the intended recipients.

Answer

The alert condition is set to trigger when count is less than 10.

Question 9

A Splunk administrator uses a macro to normalize firewall logs into the CIM Network Traffic data model. The macro includes a field alias that maps `bytes_sent` to `bytes_out`. The mapping works in ad-hoc searches, but when the macro is used in a summary index search, the field is not populated. What is the most likely reason?

Accepted Answer

The alias creates a new field that is not included in the summary index output.. The macro applies the field alias at search time, but summary index searches store the results of the search output. Since the alias field `bytes_out` is derived from `bytes_sent` and not a native field in the data, it is not automatically included in the summary index unless explicitly referenced in the search output. Therefore, the field is not populated in the summary index, making option A the correct answer.

Answer

The summary index is accelerated and overrides the alias.

Answer

Field aliases are not supported in macros.

Answer

The macro is not shared to the global context, so it fails in summary indexing.

Question 10

Which THREE of the following are required steps to properly schedule a saved search for summary indexing that runs a macro?

Accepted Answer

The summary index must be created before the search runs.. Correct answers: A, B, E. A is required because the summary index must exist before the search writes summary data. B is required because the saved search must have a schedule to run automatically. C is incorrect because the summary index is not automatically created; it must be created beforehand. D is incorrect because the macro does not have to be in the same app; it can be shared across apps. E is correct because the macro must be accessible from the context (app permissions) where the saved search runs.

Answer

The summary index is automatically created when the search runs.

Answer

The macro must be defined in the same app as the saved search.

Question 11

Which THREE are components of the Common Information Model (CIM) in Splunk?

Accepted Answer

Tags. The three components of the Common Information Model (CIM) in Splunk are Tags (A), Data Models (B), and Field Extractions (D). Tags are used to define the CIM data model's data source types and event types. Data Models provide the framework for the CIM, defining normalized fields and relationships. Field extractions are necessary to map raw data to the CIM fields. Lookup tables (C) and dashboards (E) are not part of the CIM; they may be used in conjunction with CIM but are not core components.

Answer

Lookup tables

Answer

Dashboards

Question 12

A Splunk admin wants to create a macro named `filter_by_app` that accepts an application name as an argument and returns a search string filtering by that application. The application name may contain spaces. Which of the following correctly defines the macro's arguments and usage?

Accepted Answer

Definition: `filter_by_app($app$)` and usage: `index=main app="$app$"`. Macro arguments must be referenced with $arg$ syntax and when the value contains spaces, it must be quoted. Option A defines the argument numerically (1) and uses $1$ without quotes, which fails for spaces. Option B defines the argument with $app$ (invalid syntax for definition) and uses $app$ without quotes. Option D defines 'app' without dollar signs, so the usage treats 'app' as literal text, not a variable. Option E uses $1 without a trailing dollar sign, which is invalid.

Answer

Definition: `filter_by_app(1)` and usage: `index=main app=$1$`

Answer

Definition: `filter_by_app($app$)` and usage: `index=main app=$app$`

Answer

Definition: `filter_by_app(app)` and usage: `index=main app=app`

Answer

Definition: `filter_by_app($1)` and usage: `index=main app=$1`

Question 13

A security team uses the CIM 'Authentication' data model to investigate failed logins. They have enabled acceleration on the data model and set a summary range of '1d'. After one week, searches against the data model are still slow and use the `search` command instead of `tstats`. What should they check first?

Accepted Answer

Confirm that the data model acceleration is built and that the search time range is within the summary range.. Data model acceleration must be built and the search time range must be within the summary range for `tstats` to be used. If acceleration is not built or the search time range exceeds the summary range, Splunk will fall back to the `search` command. Therefore, the first check should be confirming that acceleration is built and the search time is within the summary range.

Answer

Verify that the 'Authentication' data model is assigned to the correct index.

Answer

Ensure that the 'Authentication' data model has the 'authentication' tag on relevant events.

Answer

Check that the data model acceleration has completed building for the exact time range of the search.

Question 14

A Splunk administrator wants to reduce maintenance effort when the same search logic is used in multiple saved searches. Which approach is most effective?

Accepted Answer

Define a macro that encapsulates the common search logic and reference the macro in each saved search.. Defining a macro allows you to encapsulate the common search logic in one place and reference it in multiple saved searches. This reduces duplication and maintenance effort, as changes only need to be made in the macro definition. Option B (CIM) normalizes data but does not directly reduce maintenance of repeated search logic. Option C (summary index) adds complexity and requires additional processing steps, which increases maintenance burden. Option D (report acceleration) improves performance but does not address reuse of search logic.

Answer

Use the Common Information Model (CIM) to normalize the data and then search using data model commands.

Answer

Create a summary index that contains the output of the common logic and have each saved search reference that summary index.

Answer

Enable report acceleration on each saved search to improve performance.

Question 15

A security analyst sets up a saved search alert to trigger when more than 100 failed logins occur in 5 minutes. To avoid alert fatigue, they want to suppress the alert if the number of failed logins is the same as the previous evaluation. Which alert action setting should they configure?

Accepted Answer

Enable 'Alert suppression' and set 'Suppress if results are the same as the previous search'.. 'Alert suppression' with the setting 'Suppress if results are the same as the previous search' directly addresses the requirement to avoid alert fatigue when the number of failed logins is unchanged. Option A, 'Alert throttling', limits the frequency of alerts based on a time interval or field values, not comparison of result sets. Option C's throttle field is typically for throttling per field value, not condition-based suppression. Option D's severity and delay do not suppress based on result comparison.

Answer

Enable 'Alert throttling' based on the 'src' field.

Answer

Set the 'Throttle' field to suppress alerts for a specified time window.

Answer

Configure 'Alert severity' to low and set a delay.