SPLK-1002 Macros, Saved Searches and CIM Practice Test 7 — 15 Questions

Question 1

Order the steps to create a dashboard panel using the XML source editor in Splunk.

Accepted Answer

Open the dashboard in Edit mode, then click Source to open the XML editor, then add a panel element containing a search query and visualization, then save the XML.. Dashboard panels are defined in XML by adding a panel with a search query and visualization.

Answer

Click Source to open the XML editor, then open the dashboard in Edit mode, then add a panel element, then save.

Answer

Add a panel element, then open the dashboard in Edit mode, then click Source, then save.

Answer

Open the dashboard in Edit mode, then add a panel element, then click Source to open the XML editor, then save.

Question 2

An organization is implementing the Splunk Common Information Model (CIM) to normalize data. They have a source that provides event data with field names `src_ip` and `dst_ip`. To map these to CIM fields, which knowledge object should be created?

Accepted Answer

A field alias to create `src` from `src_ip` and `dest` from `dst_ip`. The CIM requires normalized field names such as src and dest for the Network Traffic data model. A field alias in Splunk creates a new field name that points to an existing field's value without re-extracting or duplicating data, making it the correct knowledge object to map src_ip→src and dst_ip→dest. Field aliases are search-time, lightweight, and specifically designed for CIM compliance.

Answer

A tag to tag events with `src_ip` and `dst_ip` as network traffic

Answer

A field extraction to rename `src_ip` to `src` and `dst_ip` to `dest`

Answer

A calculated field to set `src=src_ip` and `dest=dst_ip`

Question 3

A search includes the macro `mysearch(field1, field2)`. The macro definition is `stats count by $1$, $2$`. If the search is `index=main | `mysearch(user, action)`, what is the expanded search?

Accepted Answer

`index=main | stats count by user, action`. Splunk macros with arguments substitute the positional tokens `$1$` and `$2$` with the values passed at call time. In the search `index=main | `mysearch(user, action)`, `$1$` becomes `user` and `$2$` becomes `action`, so the macro definition `stats count by $1$, $2$` expands to `stats count by user, action`. The final expanded search is therefore `index=main | stats count by user, action`.

Answer

`index=main | stats count by $1$, $2$`

Answer

`index=main | | stats count by user, action`

Answer

`index=main | mysearch(user, action)`

Question 4

A saved search is configured to run every hour and generate a summary index. The original search returns data that is then summarized. Which of the following best describes the purpose of summary indexing?

Accepted Answer

To speed up searches by pre-aggregating data into smaller datasets. Summary indexing runs a scheduled search and stores its results in a separate summary index, so future searches can query the much smaller pre-aggregated dataset instead of scanning massive raw event volumes. This dramatically speeds up reporting and dashboard searches over long time ranges by trading storage for query performance.

Answer

To reduce disk space usage by compressing raw data

Answer

To create real-time alerts based on historical data

Answer

To normalize data to the CIM

Question 5

A Splunk admin is accelerating a CIM data model for the "Network_Traffic" dataset. After acceleration, some searches that use the data model are slower than expected. What is the most likely reason?

Accepted Answer

The acceleration summary range is set too low. Data model acceleration builds summary datasets over a defined time range (the 'acceleration summary range'). If this range is set too low (e.g., 1 day when searches query 7 days), searches outside the accelerated window fall back to raw event scanning, making them slower than expected. Increasing the summary range to cover the query window restores acceleration benefits.

Answer

The acceleration uses too many fields

Answer

The data model acceleration is not compatible with the CIM

Answer

Searches are not using the `| datamodel` command correctly

Question 6

A saved search is configured with a schedule but is not triggering at the expected time. The admin checks the "Job Inspector" and sees that the scheduled search is "skipped". What is a common reason for a scheduled search to be skipped?

Accepted Answer

There are too many concurrent searches scheduled. A scheduled search is marked 'skipped' when the scheduler cannot start it at its scheduled time because the search head's concurrency limits are already saturated by other running searches. Splunk enforces a maximum number of concurrent scheduled and ad-hoc searches per search head; when that limit is hit, the scheduler skips the run rather than queuing it indefinitely. This is why the Job Inspector shows a 'skipped' status instead of a failure or success.

Answer

The search time range exceeds the bucket's time range

Answer

The search is configured as a real-time search

Answer

The search string has a syntax error

Question 7

Which of the following are characteristics of the Splunk Common Information Model (CIM)? (Choose three.)

Accepted Answer

It requires the installation of the Splunk Common Information Model Add-on. Option B is correct because the CIM is delivered as the Splunk Common Information Model Add-on, which must be installed (typically alongside the Splunk Common Information Model app) to provide the data models and knowledge objects that normalize data. Option C is correct because CIM data models support acceleration, which precomputes and stores model results in summary form to speed up searches that reference the data models. Option D is correct because the CIM's core purpose is to define standard field names, event categories, and tags so that data from different sources can be searched consistently. Option A is not correct because the CIM does not automatically rename fields; field aliases, calculated fields, and lookups must be configured to map raw fields to CIM names. Option E is not correct because predefined dashboards and reports are not a defining characteristic of the CIM itself; the CIM focuses on data models, field standards, and tags.

Answer

The CIM automatically renames all fields in incoming data to match its standard

Answer

The CIM includes predefined dashboards and reports

Question 8

Refer to the exhibit. An admin configures acceleration for the Network_Traffic data model as shown. A user runs a search using the data model over the last 60 days. Why might the search be slower for data older than 7 days?

Accepted Answer

The earliest_time is set to -7d@d, so the acceleration index only covers the last 7 days. In Splunk data model acceleration, the earliest_time setting defines the start of the time range that gets summarized into the acceleration index. With earliest_time = -7d@d, only events from the last 7 days are accelerated, so searches over 60 days must fall back to raw event scanning for the older 53 days, which is dramatically slower. The acceleration only helps within the window it actually covers.

Answer

The data model is not compatible with acceleration

Answer

The summary_range is set to 30d, so only data within 30 days is accelerated

Answer

The search must use the `| datamodel` command to benefit from acceleration

Question 9

When creating a saved search that runs every hour and sends an email alert when the count of errors exceeds 10, which action must be configured in addition to the search logic?

Accepted Answer

Add an email alert action in the saved search settings.. Saved searches that trigger alerts require at least one alert action (e.g., email) to be defined in the saved search settings. Option B is incorrect because the `| alert` command is not used in search strings for saved search alerts. Option C is incorrect because a lookup table is not required for alerting. Option D is incorrect because summary indexing is unrelated to sending email alerts.

Answer

Include '| alert' command in the search string.

Answer

Create a lookup table to store error counts.

Answer

Enable summary indexing for the search.

Question 10

An organization uses the Splunk Common Information Model (CIM) to normalize data from various sourcetypes. After onboarding a new firewall vendor, the data is not populating the Network Traffic data model. Which of the following is the most likely cause?

Accepted Answer

The appropriate CIM tags have not been assigned to the new sourcetype.. CIM data models populate based on tags applied to sourcetypes and fields. For a new firewall vendor's data to appear in the Network Traffic data model, the sourcetype must be tagged with the appropriate CIM tags (e.g., `network`, `communicate`) and the fields must be normalised to CIM field names. Without these tags, the data model's search constraints do not match the events, so nothing populates.

Answer

The sourcetype is not included in the 'Network Traffic' data model acceleration.

Answer

The data is being indexed into a custom index that is not monitored by the data model.

Answer

The fields in the firewall data do not match the data model field names exactly.

Question 11

A team needs to create a saved search that runs automatically every Monday at 8 AM and emails a CSV file of the results. Besides configuring the search string, which steps are required?

Accepted Answer

Set a schedule (Cron: 0 8 * * 1) and add an email alert action with attachment format CSV.. A scheduled saved search that emails results requires two configurations beyond the search string: a cron schedule and an alert action. The cron expression '0 8 * * 1' fires at 08:00 every Monday (day-of-week 1 = Monday in Splunk's cron). Adding an email alert action with the attachment format set to CSV delivers the results as a CSV file. Together these satisfy the requirement of running weekly and emailing a CSV.

Answer

Create a dashboard panel that runs the search on schedule and sends email.

Answer

Set the search to 'Summary Index' and run a separate alert on the summary.

Answer

Define the schedule and set the time range to 'Last 7 days'.

Question 12

Which TWO benefits does the Splunk Common Information Model (CIM) provide? (Choose two.)

Accepted Answer

Provides a consistent field naming convention across different data sources.. Option A is correct because the Splunk Common Information Model normalizes event data by mapping vendor-specific fields to a common set of field names (for example, src, dest, user, action) across data models such as Network Traffic and Authentication, so searches and dashboards work consistently regardless of the underlying source. Option E is correct because CIM data models support data model acceleration, which precomputes results into TSIDX files so that searches using the tstats command run dramatically faster than raw event searches. Option B is not a CIM benefit per se; real-time correlation is provided by features such as correlation searches in Enterprise Security or the Splunk search pipeline, not by the CIM itself. Option C is wrong because the CIM does not summarize or reduce indexed data volume; it only normalizes field names and values at search time. Option D is wrong because sourcetypes are defined by the data inputs and add-ons (e.g., Splunk_TA_* apps), not by the CIM, which operates on already-parsed events.

Answer

Enables real-time correlation of events across multiple data sources.

Answer

Reduces indexing volume by summarizing data into CIM-compliant indexes.

Answer

Defines the sourcetypes for common technologies (e.g., firewall, IDS).

Question 13

A Splunk administrator wants to create a reusable search component that accepts a sourcetype and a time range. What is the correct method to define this in Splunk?

Accepted Answer

Define a macro with arguments using backticks and $arg$ syntax.. A macro with arguments is defined using backticks and $arg$ syntax, and it can be invoked in a search to accept parameters such as a sourcetype and time range. This is the correct method for creating a reusable search component that accepts parameters. The macro definition uses `$arg$` placeholders, and the invocation passes values in the backtick-delimited call.

Answer

Create a saved search that uses tokens to parameterize the query.

Answer

Use an eval statement to define a variable that holds the query.

Answer

Use a lookup definition with parameters to filter results.

Question 14

A user reports that a macro named `my_macro` is not expanding in a search. The macro is defined in a private app called 'App_A'. The user is running the search in a different app called 'App_B'. What is the most likely cause of the issue?

Accepted Answer

The macro is not shared to the global context.. In Splunk, macros are scoped to the app where they are defined unless they are shared to the global context. A macro defined in a private app (App_A) is only available within that app. When a user runs a search in a different app (App_B), the macro will not be found unless it has been shared globally or exported to App_B. Therefore, the most likely cause is that the macro is not shared to the global context.

Answer

The macro has a syntax error that prevents expansion.

Answer

The user does not have permission to view the macro.

Answer

The macro name is case-sensitive and the user used wrong case.

Question 15

A user defined a macro that includes a lookup command. The macro works correctly in ad-hoc searches. However, when the macro is used in a scheduled saved search, the macro fails to expand. Administration confirms the macro is shared globally. What is the most likely cause of this failure?

Accepted Answer

The lookup used in the macro is not accessible in the saved search's app context.. Scheduled saved searches run under the context of the app where the saved search is defined. Even though the macro itself is shared globally, any commands or lookups used within the macro must be accessible in that app context. If the lookup used in the macro is defined in a different app and not shared to the saved search's app, the macro will fail at schedule time while working in ad-hoc searches where the user has access to the lookup. Therefore, option B is correct. Option A is unlikely because macro arguments would cause failure in ad-hoc as well. Option C is false as administration confirmed the macro is shared globally. Option D is incorrect because a syntax error would also manifest in ad-hoc searches.

Answer

The macro expects arguments that are not provided in the saved search.

Answer

The macro is not shared to the global context despite confirmation.

Answer

The macro contains a syntax error that only appears at schedule time.