SPLK-1002 Macros, Saved Searches and CIM Practice Test 6 — 15 Questions

Question 1

A Splunk administrator wants to create a saved search that runs every hour and sends an email if the number of events exceeds a threshold. The administrator also wants to ensure that the search results are cached for faster dashboard loading. Which setting should be configured on the saved search?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the 'Run search on a schedule' option and set the schedule to hourly.. Scheduled saved searches run at defined intervals and store their results. When a dashboard references a saved search, it can retrieve the pre-computed results, reducing load and improving load times. Enabling a schedule and setting it to hourly meets both the execution frequency and the caching requirement. Other options either do not cache results or are not designed for this purpose.

Answer

Enable summary indexing.

Answer

Set the search to run in real-time.

Answer

Add the search to a dashboard and enable 'Refresh' on the dashboard panel.

Question 2

A Power User creates an event type named "brute_force" with the search `index=security failed_login=true` and tags it with the tag `authentication`. A colleague then runs `tag=authentication` and gets results, but running `eventtype=brute_force` returns nothing. Both users have read access to the event type. What is the most likely reason the eventtype search returns no results?

Accepted Answer

The event type definition includes a field that is not extracted or indexed in the data being searched, so the expanded search matches nothing.. An eventtype reference expands to the search string stored in the event type definition, so any field used there must actually be present and extracted for events to match. A tag, by contrast, is attached to events directly and can match even when the underlying field-based definition does not. This difference explains why the tag query returns events while the eventtype query returns none.

Answer

The event type was created with app-level sharing, so only searches run inside that specific app can resolve the eventtype name.

Answer

The event type name contains an underscore, which is not permitted in eventtype names and causes silent resolution failure.

Answer

The event type was defined without the required leading index constraint, so Splunk cannot map the eventtype reference to a searchable definition.

Question 3

A Splunk Power User is creating a macro that uses a lookup to enrich events with user department information. The lookup file is updated weekly, and the macro should always use the latest data. The macro is defined as: `lookup user_departments user_id OUTPUT department`. After saving, the user runs a search that includes the macro, but the results show outdated department information. What is the most likely cause?

Accepted Answer

The lookup file was updated, but the lookup definition in Splunk was not refreshed; Splunk caches lookup files until the definition is updated or the cache is cleared.. Splunk caches lookup files to improve performance. When a lookup file is updated on disk, Splunk may continue to use the cached version until the lookup definition is refreshed or the cache expires. This leads to outdated data in search results. The macro simply references the lookup, so the caching behavior of the lookup definition is the root cause. Other options do not explain why the data is outdated but matches are still occurring.

Answer

The macro is using a lookup that is not shared globally, so it is using a local copy.

Answer

The lookup command in the macro is using a lookup definition that has a case-sensitive match, causing some events to not match.

Answer

The lookup file was not refreshed in Splunk; the lookup definition needs to be updated to point to the new file.

Question 4

A Splunk Power User is creating a macro that will be used in a scheduled search owned by the 'admin' user but run with the permissions of the 'splunk-system-user'. The macro references a lookup file that is only available to the 'admin' user. What must the Power User do to ensure the macro executes successfully in the scheduled search?

Accepted Answer

Set the macro permissions to 'Global' and ensure the lookup file is also shared globally.. Scheduled searches run with the permissions of the specified run-as user. For the macro and its dependencies to be available, they must be shared with that user. Setting the macro and lookup to global ensures they are accessible regardless of the run-as context, preventing permission-related failures.

Answer

Change the scheduled search to run as the 'admin' user instead of 'splunk-system-user'.

Answer

Embed the lookup file contents directly into the macro definition.

Answer

Add the 'splunk-system-user' to the 'admin' role so it inherits access to the lookup.

Question 5

A Splunk administrator needs to create a saved search that runs every hour and sends an email alert only if the result count exceeds 500. The search uses a macro that includes a `stats` command. After scheduling, the alert never fires even though manual runs show counts over 500. What is the most likely reason?

Accepted Answer

The macro used in the saved search is not shared with the user account that owns the scheduled search, so the search fails to expand the macro.. Scheduled searches execute under the permissions of their owner. If the macro used in the search is not shared with that owner, the search cannot expand the macro, leading to failure or empty results. Manual runs by a user with access succeed, but the scheduled search fails silently, so the alert never fires. Ensuring the macro is shared globally or with the appropriate role resolves the issue.

Answer

The saved search is configured to run in real-time mode, which is not supported for scheduled alerts.

Answer

The saved search is configured with a cron schedule that does not align with the hour.

Answer

The alert condition is set to "if number of results is greater than 500" but the search returns a single row with a count field, so the condition never evaluates true.

Question 6

A Splunk administrator is designing a new data model in the Common Information Model (CIM) to normalize web proxy logs. The administrator wants to ensure the data model is CIM-compliant and can be accelerated. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Validate the data model using the `datamodel` command to ensure it returns expected results.. To create a CIM-compliant data model for web proxy logs, the administrator must map fields to the appropriate CIM data models and validate the model using the `datamodel` command. These steps ensure the data is normalized and searchable according to CIM standards. Acceleration settings and event constraints are optional optimizations, not core requirements.

Answer

Define event constraints to filter only relevant events for the data model.

Answer

Use the `eval` command to rename fields to match CIM field names.

Answer

Ensure all fields in the data model are accelerated by setting the acceleration policy to 'All fields'.

Question 7

A Splunk administrator is reviewing a saved search that uses a macro. The macro is defined with the following arguments: `$index$`, `$sourcetype$`. The saved search invokes the macro as `` `my_macro(index=main, sourcetype=access_combined)` ``. However, the search fails with an error about invalid arguments. What is the correct way to invoke this macro?

Accepted Answer

`my_macro(main, access_combined)`. Macros defined with positional arguments (e.g., `$1$`, `$2$` or named placeholders like `$index$`) are invoked by passing the values in order, separated by commas. The argument names are not used in the invocation. Therefore, the correct syntax is `` `my_macro(main, access_combined)` ``. This passes 'main' as the first argument and 'access_combined' as the second, matching the macro definition.

Answer

`my_macro(index="main", sourcetype="access_combined")`

Answer

`my_macro(main access_combined)`

Answer

`my_macro($index$=main, $sourcetype$=access_combined)`

Question 8

A Splunk admin is asked to expose a macro for reuse across several apps in the same search head cluster while preventing individual app owners from modifying it. Where should the macro be defined and what should be set?

Accepted Answer

Define the macro in an app's `default/macros.conf` file under `$SPLUNK_HOME/etc/apps/<app>/default/` and set `iseval=0` with no private flag.. Placing the macro in an app's `default` directory makes it part of the app's shipped configuration, which other apps on the search head can invoke when it is not marked private. The `default` layer resists casual local edits, giving administrators control, while `iseval=0` keeps it as a standard search macro rather than an eval macro. This balances reuse with change control across the cluster.

Answer

Define the macro in `$SPLUNK_HOME/etc/system/local/macros.conf` and set `private=1` so only system-level users can run it.

Answer

Define the macro in a lookup definition inside the app and reference it with the `lookup` command in each consuming app.

Answer

Define the macro in the `$SPLUNK_HOME/etc/apps/search/local/macros.conf` file and mark it as private to the search app.

Question 9

Which TWO of the following are valid uses of the Common Information Model (CIM) in Splunk?

Accepted Answer

Defining tags and event types to categorize data.. Option D is correct because the Common Information Model (CIM) in Splunk is used to define tags and event types that categorize data into standardized models, enabling consistent searching and reporting across diverse data sources. Option E is correct because the CIM's core purpose is to normalize data from different sources into a common field naming convention, so that fields like src, dest, and user have consistent meanings regardless of the original sourcetype. Options A, B, and C are incorrect because user roles and permissions are handled by Splunk's role-based access control (RBAC) and authentication configuration, license usage is managed through the licensing manager and license pools, and creating indexes is an index management task; none of these are functions of the CIM.

Answer

Defining user roles and permissions for data access.

Answer

Managing license usage across indexers.

Answer

Creating new indexes for faster search performance.

Question 10

Which THREE of the following are best practices for creating saved searches?

Accepted Answer

Set an appropriate time range to limit the data scanned.. Option B is correct because setting an appropriate (narrow) time range limits the amount of data scanned, which reduces search cost and improves performance, especially for saved searches that run repeatedly. Option C is correct because summary indexing precomputes and stores results of frequently run searches, so subsequent runs read the smaller summary index instead of re-scanning raw data, dramatically improving efficiency. Option E is correct because descriptive names that indicate the search's purpose make saved searches easier to identify, manage, share, and maintain across a team. Option A is not a best practice because saved searches are often scheduled deliberately to automate reporting and alerting, and simply not scheduling them does not address search efficiency. Option D is not a best practice because relying on the default time range can cause unpredictable or overly broad data scans; an explicit, appropriate time range should be set instead.

Answer

Save the search without scheduling it to avoid resource usage.

Answer

Avoid specifying a time range to use the default.

Question 11

A Splunk administrator notices that a scheduled saved search `Daily Summary` fails every day at 2:00 AM with the error "Search job expired due to inactivity." The search runs against a large index and takes about 30 minutes to complete. What is the most likely cause?

Accepted Answer

The scheduled search is configured with a time limit shorter than 30 minutes.. The error 'Search job expired due to inactivity' indicates that the scheduled search was terminated before it could complete. In Splunk, saved searches have a configurable time limit (default 10 minutes) that specifies the maximum runtime before the search is killed. Since the search takes 30 minutes, the time limit must be set to less than 30 minutes, causing the premature termination.

Answer

The user who owns the saved search does not have permissions to run it at that time.

Answer

The indexer has reached its license quota and stops processing.

Answer

The search is consuming too much disk space.

Question 12

Which TWO of the following are valid ways to create a macro in Splunk? (choose two)

Accepted Answer

Navigate to Settings > Advanced search > Search macros and click 'New'.. Option C is correct because Splunk Web provides the Settings > Advanced search > Search macros page, where clicking 'New' opens the macro editor to define a macro's name, definition, arguments, and app context, which is the standard GUI method for creating macros. Option D is correct because macros are stored in macros.conf, and placing a macros.conf file in $SPLUNK_HOME/etc/system/local/ is a valid manual configuration method that Splunk reads as a local, user-created configuration. Option A is incorrect because props.conf is used for source type, field extraction, and line-breaking settings, not macro definitions. Option B is incorrect because Splunk's CLI does not provide a `splunk add macro` command for creating macros. Option E is incorrect because editing files in an app's default directory is not a valid creation method; default/ is reserved for the app's shipped, read-only configurations, and custom macros should be placed in local/ to avoid being overwritten on upgrade.

Answer

Add a macro definition to props.conf under a [source] stanza.

Answer

Use the CLI command `splunk add macro` with the macro definition.

Answer

Edit the macros.conf file in the app's default directory.

Question 13

Which TWO of the following are valid reasons to use the Common Information Model (CIM) in a Splunk environment?

Accepted Answer

It improves the ability to correlate events from different technologies.. Option A is correct because CIM normalizes data from disparate sources into a common schema of event categories, tags, and field names, which lets Splunk correlate activity across different technologies (for example, matching a firewall event with an authentication event on shared fields like src, dest, and user). Option B is correct because CIM's standardized field names (such as src, dest, user, action) allow a single search or data model to query many different sourcetypes without rewriting field references per source. Option C is not a CIM benefit: pre-aggregation for performance is provided by data model acceleration and summary indexing, not by CIM itself. Option D is not a CIM function: CIM supplies the normalized schema, while security monitoring use cases come from apps like Splunk Enterprise Security and its correlation searches. Option E is incorrect because CIM still requires field extractions or aliases to map raw fields to CIM-compliant names; it standardizes the target schema but does not remove the need for extraction work.

Answer

It improves search performance by pre-aggregating data.

Answer

It provides built-in security monitoring use cases.

Answer

It eliminates the need for custom field extractions.

Question 14

Order the steps to configure a field extraction using the Field Extractor (FX) in Splunk.

Accepted Answer

1. Select a sample event, 2. Highlight the field value in the event, 3. Name the field, 4. Save the extraction.. The Field Extractor guides you through selecting sample data, defining extraction rules, testing, and saving.

Answer

1. Highlight the field value, 2. Select a sample event, 3. Name the field, 4. Save the extraction.

Answer

1. Name the field, 2. Select a sample event, 3. Highlight the field value, 4. Save the extraction.

Answer

1. Select a sample event, 2. Name the field, 3. Highlight the field value, 4. Save the extraction.

Question 15

Order the steps to create a data model in Splunk in the correct order.

Accepted Answer

Step 1: Create a new data model. Step 2: Add a root event type. Step 3: Define constraints for the event type. Step 4: Add fields to the event type.. Data models are created by defining hierarchical objects with constraints and fields.

Answer

Step 1: Add a root event type. Step 2: Create a new data model. Step 3: Define constraints. Step 4: Add fields.

Answer

Step 1: Create a new data model. Step 2: Define constraints. Step 3: Add a root event type. Step 4: Add fields.

Answer

Step 1: Create a new data model. Step 2: Add a root event type. Step 3: Add fields. Step 4: Define constraints.