SPLK-1002 Macros, Saved Searches and CIM Practice Test 8 — 15 Questions

Question 1

Which Common Information Model (CIM) data model is appropriate for standardizing authentication events?

Accepted Answer

Authentication. The Authentication data model in the Splunk CIM is purpose-built to normalize authentication-related events such as logins, logouts, and failed authentication attempts. It defines fields like user, src, dest, action, and app that security teams use for consistent correlation across disparate identity sources. This makes it the correct choice for standardizing authentication events.

Answer

Change Analysis

Answer

Network Traffic

Answer

Endpoint

Question 2

A Splunk administrator needs to schedule a saved search to run every second Friday at 10:00 AM. Which cron expression should be used?

Accepted Answer

0 10 8-14 * 5. The cron expression '0 10 8-14 * 5' fires at 10:00 AM on day-of-week 5 (Friday) but only when the day-of-month is between 8 and 14 — which is exactly the second Friday of the month. This is the standard way to express 'second Friday' in cron, since the second Friday always falls on days 8-14. The other fields (minute 0, hour 10, any month) complete the schedule.

Answer

0 10 * * 5

Answer

0 10 */2 * *

Answer

0 10 * * *

Question 3

In the CIM, which field is commonly used to identify the user responsible for an authentication event?

Accepted Answer

user. In the CIM Authentication data model, the 'user' field represents the user who is the subject of the authentication event — the account being authenticated. This is the standard field for identifying the responsible user in login, logout, and failed authentication events. It is distinct from src_user, which represents the user who initiated the action on behalf of another user.

Answer

dest

Answer

src_user

Answer

src

Question 4

A saved search is configured to run every 5 minutes and send an alert when the count of failures exceeds 10. After several days, users report they are not receiving alerts even though failures are occurring. The saved search runs successfully and produces results. What is the most likely cause?

Accepted Answer

Alert throttling is enabled and suppressing subsequent alerts.. The most likely cause is that alert throttling is enabled and suppressing subsequent alerts. Throttling limits the number of alerts triggered by a saved search within a specified period. If the search runs every 5 minutes and failures exceed 10 frequently, throttling may suppress alerts after the first one, preventing users from receiving further notifications.

Answer

The saved search owner does not have permission to send alerts.

Answer

The alert action is not configured to send to the intended recipients.

Answer

The alert condition is set to trigger when count is less than 10.

Question 5

Which THREE of the following are required steps to properly schedule a saved search for summary indexing that runs a macro?

Accepted Answer

The summary index must be created before the search runs.. Option A is correct because summary indexing writes results into a pre-existing summary index, so the target index must be created (via Settings > Indexes or indexes.conf) before the scheduled search executes. Option B is correct because a saved search only runs automatically when a schedule (cron expression or interval) is configured on it; without a schedule, no summary indexing occurs. Option E is correct because the macro invoked by the search must be visible in the search's execution context — i.e., it must be a global macro or defined in the app whose context the saved search runs under — otherwise the search fails to resolve the macro. Option C is wrong because Splunk does not auto-create a summary index; the index must exist beforehand. Option D is wrong because the macro need not be in the same app as the saved search; it only needs to be accessible from the search's context, which can be achieved via a global macro or proper app context.

Answer

The summary index is automatically created when the search runs.

Answer

The macro must be defined in the same app as the saved search.

Question 6

A Splunk administrator wants to reduce maintenance effort when the same search logic is used in multiple saved searches. Which approach is most effective?

Accepted Answer

Define a macro that encapsulates the common search logic and reference the macro in each saved search.. Defining a macro allows you to encapsulate the common search logic in one place and reference it in multiple saved searches. This reduces duplication and maintenance effort, as changes only need to be made in the macro definition. Option B (CIM) normalizes data but does not directly reduce maintenance of repeated search logic. Option C (summary index) adds complexity and requires additional processing steps, which increases maintenance burden. Option D (report acceleration) improves performance but does not address reuse of search logic.

Answer

Use the Common Information Model (CIM) to normalize the data and then search using data model commands.

Answer

Create a summary index that contains the output of the common logic and have each saved search reference that summary index.

Answer

Enable report acceleration on each saved search to improve performance.

Question 7

A systems engineer creates a summary index using a saved search that runs every 30 minutes. The summary index aggregates data from multiple sourcetypes. After a week, the engineer notices that the summary index contains duplicate events for certain time ranges. What is the most likely cause?

Accepted Answer

The summary index time range extends beyond the schedule interval, causing overlapping windows.. Duplicate events in a summary index typically occur when the saved search's time range overlaps between scheduled runs. If the search runs every 30 minutes but its time range covers, say, the last hour, each run re-summarizes events already captured in the previous run, producing duplicates. The fix is to align the search time range with the schedule interval (e.g., use '-30m to now' for a 30-minute schedule) or use a deduplication approach.

Answer

The macro used in the saved search includes a time zone conversion that shifts events.

Answer

The saved search schedule is set to run at the wrong time.

Answer

The summary index acceleration is enabled, causing automatic re-summarization.

Question 8

A user reports that a macro named `my_macro` is not working in a search. The macro is defined with no arguments and uses a simple search string. What is the most likely issue?

Accepted Answer

The macro permissions are not shared to the user's role.. In Splunk, macros have permissions that determine which users or roles can access them. If a macro is not shared with the user's role, the user will not be able to use it in searches, even if the macro name is correct and the definition is valid. Since the macro is defined with no arguments and uses a simple search string, the most likely issue is a permissions problem. The user must have the macro shared to their role or be in a role that has access.

Answer

The macro is defined with wrong arguments.

Answer

The macro name is misspelled in the search.

Answer

The macro contains a subsearch that fails.

Question 9

A team develops multiple dashboards that share common search logic. What is the best practice for managing these searches?

Accepted Answer

Use macros to define reusable search fragments.. Macros allow reusable search fragments that can be used across multiple dashboards, reducing duplication and simplifying maintenance. Embedding search strings directly in each dashboard (option C) causes duplication and is hard to maintain. Creating a saved search for each dashboard (option A) still duplicates logic. Using a single saved search that all dashboards reference (option B) may not be flexible enough for different dashboard requirements. Therefore, macros are the best practice.

Answer

Create a saved search for each dashboard.

Answer

Use a single saved search that all dashboards reference.

Answer

Embed the search strings directly in each dashboard.

Question 10

An alert saved search runs every 5 minutes and is set to trigger when count > 0. The alert keeps triggering repeatedly for the same events. What is the recommended solution?

Accepted Answer

Increase the alert throttle period.. When an alert triggers repeatedly for the same events, the standard fix is to configure throttling so the alert suppresses duplicate notifications for a defined period. Increasing the throttle period prevents the same triggering events from generating repeated alerts. This is the built-in Splunk mechanism for alert deduplication.

Answer

Set the alert to trigger once per hour.

Answer

Disable the alert and re-enable.

Answer

Change the condition to count > 1.

Question 11

Which three of the following are benefits of using the Common Information Model (CIM)? (Choose THREE.)

Accepted Answer

Ensures consistent field naming across data sources.. Option A is correct because CIM enforces a standardized set of field names and tags (e.g., src, dest, user, action) so that data from heterogeneous sources is normalized into consistent field naming across data sources, enabling searches and correlation to work uniformly. Option B is correct because CIM ships with pre-built data models for common domains such as Authentication, Network Traffic, Web, and Endpoint, which provide predefined objects, fields, and constraints that accelerate analytics without building schemas from scratch. Option E is correct because once data is mapped to CIM data models, dashboards, reports, and searches built against those models become portable and can be shared and reused across different environments and data sources. Option C is not correct because CIM still requires field aliases and lookups (custom field extractions or knowledge objects) to map raw source fields into the CIM-compliant names; it does not eliminate that mapping work. Option D is not correct because CIM is a normalization and modeling framework, not a compliance reporting engine, and it does not automatically generate compliance reports.

Answer

Reduces the need for custom field extractions.

Answer

Automatically generates reports for compliance.

Question 12

A saved search alert is configured to run every 10 minutes and trigger when the count of error events exceeds 5. The search returns results when run manually, but the alert never triggers. The admin checks the alert history and sees entries for the previous runs but all show 'Trigger: False'. They also confirm that the search returns count > 5 for those periods. What is the likely cause?

Accepted Answer

The alert condition is set to 'when number of results is greater than 5' but it should be 'when count field is greater than 5'.. The alert is configured to trigger when the number of results is greater than 5, but the search likely returns a single result with a count field (e.g., using `stats count`). The alert condition evaluates the number of results, not the value of the count field, so even when the count exceeds 5, the number of results is still 1, causing the alert not to trigger. Therefore, the correct fix is to change the condition to 'when count field is greater than 5' (Option D). Option A is incorrect because throttling would suppress alerts after a trigger, not prevent them from triggering. Option B is incorrect because summary indexes are searchable by alerts. Option C is incorrect because the admin confirmed the counts from manual runs match the periods, indicating the time range is correct.

Answer

The alert is disabled due to throttling or suppression settings.

Answer

The search uses a summary index that is not searchable by the alert system.

Answer

The time range in the saved search does not align with the alert schedule.

Question 13

A Splunk admin is tasked with creating a set of macros that will be used by multiple app developers to standardize searches across the organization. The macros need to accept parameters such as index, sourcetype, and time range. Some macros will be complex and include subsearches. Which approach should the admin take to ensure maximum reusability and maintainability?

Accepted Answer

Use macro arguments with default values and include comments in the definition.. Macros with arguments and default values allow a single definition to be reused across many searches while letting callers override index, sourcetype, or time range as needed. Embedding comments in the macro definition documents intent and usage for other developers, improving maintainability. This combination maximizes reusability without duplicating logic or forcing developers to edit macro code directly.

Answer

Create separate macros for each combination of parameters.

Answer

Embed all logic into a single macro and use conditional statements.

Answer

Define macros with no arguments and rely on the developers to modify the macro code.

Question 14

A Splunk power user maintains a macro named `net_flow_summary` whose definition is `stats sum(bytes) as total_bytes by src, dest`. Several scheduled saved searches invoke it as `` `net_flow_summary(dest)` `` and have run successfully for weeks. A new saved search invokes the same macro as `` `net_flow_summary(src, dest)` `` and fails with an error about argument count. What is the most likely cause?

Accepted Answer

The macro definition must be updated to `stats sum(bytes) as total_bytes by $1$, $2$` so it can accept two arguments.. A macro accepts only as many arguments as its definition references through positional tokens such as $1$ and $2$. Because this definition uses only $1$, it is a one-argument macro, and invoking it with two comma-separated values produces an argument-count error. Updating the definition to reference both $1$ and $2$ aligns the macro with the new invocation.

Answer

Argument values passed to a macro must be enclosed in quotes, so the invocation should be `` `net_flow_summary("src", "dest")` ``.

Answer

Macros that contain a `stats` command cannot be invoked from scheduled saved searches and must be run ad hoc first.

Answer

The macro must be converted from an eval-based macro to a search-based macro before it can accept multiple arguments.

Question 15

A Splunk administrator maintains a macro named `net_agg` that is invoked by twelve different saved searches across the org. A change to the underlying firewall sourcetype means the macro's base search must now use `sourcetype=pan:traffic` instead of `sourcetype=cisco:asa`. The admin edits the macro definition once and saves it. What is the result for the existing saved searches?

Accepted Answer

All twelve saved searches use the updated definition the next time they run, with no edits to the saved searches.. Macros are stored as reusable SPL definitions and expanded when a search is dispatched, so updating the macro's definition propagates to every saved search that calls it without touching those saved searches. This central maintenance is exactly why macros are used for logic shared across many searches. Re-saving, re-importing, or separating scheduled execution would all be unnecessary or incorrect.

Answer

The saved searches fail until the macro is re-imported into each app that owns them.

Answer

Each saved search must be re-saved individually before the new sourcetype is picked up.

Answer

The change applies only to ad-hoc searches; scheduled saved searches keep the original definition.