SPLK-1002 Macros, Saved Searches and CIM Practice Test 9 — 15 Questions

Question 1

A Splunk power user needs a reusable search snippet that accepts a hostname as an argument and returns the average CPU usage for that host. The snippet will be used in multiple saved searches and dashboards. The user wants to ensure that when the macro is invoked without specifying the hostname, it defaults to 'web01'. Which of the following is the correct way to define the macro?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a search macro with arguments: hostname=web01, and set the definition to: `index=perf | stats avg(cpu) as avg_cpu by host | search host=$hostname$`. To provide a default value for a macro argument, the argument must be defined with an equals sign and the default value, such as hostname=web01. This allows the macro to be invoked with or without that argument, using the default when omitted. The other options do not correctly set a default for the macro argument.

Answer

Create a search macro with arguments: hostname, and set the definition to: `index=perf | stats avg(cpu) as avg_cpu by host | search host=$hostname$ | fillnull value="web01" hostname`

Answer

Create a search macro with arguments: hostname, and set the definition to: `index=perf | stats avg(cpu) as avg_cpu by host | search host=$hostname$`

Answer

Create a search macro with arguments: hostname, and set the definition to: `index=perf | stats avg(cpu) as avg_cpu by host | search host=$hostname$ | eval hostname="web01"`

Question 2

A Splunk administrator needs to create a macro named `get_errors` that filters events where the `log_level` field equals `ERROR`. The macro will be used frequently in ad-hoc searches by the security team. The administrator wants the macro to be available to all users but only editable by members of the `admin` role. Which of the following is the correct configuration for the macro's permissions?

Accepted Answer

Set the macro's sharing to App and assign read permissions to all roles, and write permissions only to the admin role.. The macro must be usable by all users but editable only by admins. Sharing it at the app level with read permissions for all roles and write permissions for the admin role achieves this. Splunk's permission model separates read and write access, allowing granular control. Global sharing would extend beyond the app, and private sharing would limit usage.

Answer

Set the macro's sharing to App and assign read and write permissions to all roles.

Answer

Set the macro's sharing to Private and then manually share it with each user.

Answer

Set the macro's sharing to Global and assign read and write permissions to the admin role only.

Question 3

A Power User needs a saved search that runs every Monday at 06:00 and writes a summarized count of events per host into the `summary` index. The user creates the search and sets it to run on a cron schedule, but wants to confirm the schedule expression that produces a 06:00 Monday run. Which cron expression should be used?

Accepted Answer

`0 6 * * 1`. Splunk cron expressions order fields as minute, hour, day-of-month, month, day-of-week, with day-of-week 0 being Sunday and 1 being Monday. A weekly 06:00 Monday run therefore requires minute 0, hour 6, and day-of-week 1, with wildcards for day-of-month and month. Mistaking the day-of-week numbering or swapping the minute and hour fields are the common failure modes.

Answer

`0 6 * * 0`

Answer

`0 6 1 * *`

Answer

`6 0 * * 1`

Question 4

A Splunk Power User wants to create a macro that returns the top 5 values of a field, where the field name is passed as an argument, and the result should be sorted in descending order. The macro should be reusable across multiple searches. Which macro definition will accomplish this?

Accepted Answer

`stats count by $field$ | sort - count | head 5`. The macro should return the top 5 values of a field, which in Splunk typically means the most frequent values. Using stats count by the field, sorting by count descending, and limiting to 5 achieves this. This definition is parameterized with $field$, making it reusable. Other options either sort by field value rather than count, or do not aggregate counts, thus not meeting the common interpretation.

Answer

`sort - $field$ | head 5`

Answer

`top $field$ limit=5`

Answer

`dedup $field$ | sort - $field$ | head 5`

Question 5

A Splunk administrator is designing a saved search that runs every hour to detect potential data gaps. The search should alert only if the total event count for the previous hour is less than 100. The administrator wants to avoid false positives during scheduled maintenance windows when data ingestion is intentionally paused. Which of the following approaches best meets these requirements?

Accepted Answer

Create a saved search with a cron schedule of '0 * * * *' and a condition that triggers an alert when the event count is less than 100, and add a time-based filter to exclude maintenance windows using a lookup of known maintenance periods.. Using a lookup of known maintenance windows allows the search to dynamically exclude time periods when low event counts are expected. This is more precise than throttling, weekday-only schedules, or host-based exclusions, which do not directly address scheduled maintenance. The lookup can be maintained and updated as needed, providing a flexible solution.

Answer

Create a saved search with a cron schedule of '0 * * * *' and a condition that triggers an alert when the event count is less than 100, and configure the alert to run only on weekdays.

Answer

Create a saved search with a cron schedule of '0 * * * *' and a condition that triggers an alert when the event count is less than 100, and set the alert to throttle for 24 hours to avoid repeated alerts.

Answer

Create a saved search with a cron schedule of '0 * * * *' and a condition that triggers an alert when the event count is less than 100, and add a subsearch that excludes events from the maintenance host.

Question 6

A Splunk Power User is building a scheduled saved search that must run every day at 06:00 and email a CSV of results to the security team. The saved search is created in the Search & Reporting app, but the team also wants it visible when they open the Enterprise Security app. Which action makes the saved search available in both apps without duplicating it?

Accepted Answer

Change the saved search's permissions so it is shared globally (All apps), then grant the appropriate roles read access.. Saved searches and other knowledge objects have a sharing scope. When the scope is set to global, the object is available across all apps, so users working in Enterprise Security can see and use the same saved search created in Search & Reporting. Read permissions granted to the relevant roles determine which users can view or run it, and no duplication or app packaging is needed.

Answer

Move the saved search into the /opt/splunk/etc/apps/search/local/savedsearches.conf file and restart Splunk Enterprise so the configuration is reloaded.

Answer

Set the saved search permissions to be shared in the current app only, then add the Enterprise Security app to the search's app context list.

Answer

Export the saved search as an app and install that app on the search head, then reference it from Enterprise Security dashboards.

Question 7

A Power User creates a saved search named `hourly_errors` and shares it at the app level so teammates in the same app can use it. A teammate in a different app reports that the saved search does not appear in their Searches, Reports, and Alerts list. What is the most likely explanation?

Accepted Answer

App-level sharing limits visibility to users of that app; the search must be promoted or globally shared for other apps to see it.. Saved search visibility is governed by sharing permissions: app-level sharing exposes the object only within its owning app, while promoting or globally sharing it makes it available to users in other apps. A teammate in a different app therefore cannot see an app-scoped saved search. The schedule_search capability controls scheduling rights, not list visibility, and restarts are irrelevant to permission scope.

Answer

Saved searches are only visible to the user who created them until the search head is restarted.

Answer

Saved searches can never be shared across apps, so the teammate must recreate it.

Answer

The teammate's role lacks the `schedule_search` capability, which also hides saved searches from the list.

Question 8

A Splunk Power User maintains a macro named `net_errors` defined with arguments as `sourcetype=$st$ status=error | stats count by host`. Several saved searches call it as `` `net_errors(firewall)` ``. The admin later needs one specific saved search to also break the count down by `src_ip` without altering the macro for everyone else. What is the most appropriate way to accomplish this within Splunk?

Accepted Answer

Create a second argumentized macro such as `net_errors_by_ip($st$,$grp$)` that appends `, $grp$` to the stats clause, and point only that saved search at it.. Passing the grouping field as a macro argument lets the shared definition remain generic while a single saved search requests the additional breakdown. Only the invocation changes, so other searches that call the original macro keep their host-only results. This preserves reuse and avoids the ripple effects of editing or deleting the shared macro, which is the core reason argumentized macros are preferred for scenario-specific variations.

Answer

Copy the macro body inline into the one saved search and add the extra by-field there, then delete the original macro to prevent drift.

Answer

Edit the existing `net_errors` macro definition to add `src_ip` to the stats clause, since macro changes propagate to all saved searches automatically.

Answer

Add `src_ip` to the stats clause of the macro and rely on the `ISNULL` function to hide the extra column in the other saved searches.

Question 9

A Splunk power user is working with the Common Information Model (CIM) and needs to ensure that a custom sourcetype for a new application is properly mapped to the Authentication data model. The application logs contain fields: user, src_ip, action, and status. The user wants to create a tag and event type to facilitate this mapping. Which of the following is the correct approach?

Accepted Answer

Create an event type that matches the sourcetype, then add the tag 'authentication' to the event type, and ensure the fields are aliased to the CIM field names using field aliases.. The correct approach involves creating an event type with the appropriate tag and using field aliases to map custom fields to CIM field names. This ensures the data model can correctly identify and normalize the events. The other options either misplace tags or rely on automatic mapping that does not exist without proper configuration.

Answer

Create an event type that matches the sourcetype, then add the tag 'authentication' to the event type, and use the CIM add-on to automatically map the fields based on field names.

Answer

Create a field alias for each field to match the CIM names, then add the tag 'authentication' to the sourcetype using the Tags field in the sourcetype configuration.

Answer

Create a tag named 'authentication' and apply it directly to the sourcetype, then use the CIM editor to manually map fields.

Question 10

A Splunk admin needs a macro that adds a computed severity label based on the `status` field and must guarantee it only runs where `status` exists. The admin writes the definition as `eval severity=case(status>=500,"critical",status>=400,"warning",true(),"info")` and saves it. A search on a sourcetype lacking `status` invokes the macro and returns rows with `severity=info`. What explains this behavior?

Accepted Answer

The `case` function's `true()` clause always matches, so rows without `status` fall through to the default label because a missing field compares as null.. Because `case` evaluates conditions in order and `true()` is an unconditional match, any event whose `status` does not satisfy the numeric branches receives the `info` label. Missing fields simply fail the numeric comparisons, so they land in the catch-all. To avoid labeling events that lack the field, the macro should test for field existence before assigning severity.

Answer

The `eval` command automatically creates missing fields with the value `info` when a `case` expression references them.

Answer

The macro's `true()` clause is ignored when the referenced field is null, so Splunk applies the default `info` label from the macro's metadata.

Answer

The macro failed to expand because `status` is missing, so Splunk reused the last successful expansion and labeled the rows `info` from cache.

Question 11

A security analyst wants to use a macro that accepts two arguments: a field name and a value to filter on. The macro should be invoked as `filter(field, value)` and should expand to `field=value`. Which macro definition correctly achieves this?

Accepted Answer

`$1$=$2$`. Splunk macros use positional arguments referenced as $1$, $2$, etc. To define a macro that takes two arguments and expands to `field=value`, the definition must be `$1$=$2$`. This ensures that when the macro is invoked with specific field and value, they are correctly substituted in the search.

Answer

`$field$=$value$`

Answer

`$field$=$2$`

Answer

`$arg1$=$arg2$`

Question 12

A Splunk Power User is creating a macro to normalize web proxy logs. The macro must extract the `action` field from the raw event and map it to the CIM `action` field. The raw event contains a field called `proxy_action` with values like 'allowed' or 'blocked'. The macro definition is: `eval action=case(proxy_action=="allowed", "allowed", proxy_action=="blocked", "blocked", true(), "unknown")`. When the macro is used in a search, the `action` field is not populated correctly. What is the most likely cause?

Accepted Answer

The `proxy_action` field is not extracted before the macro is applied.. The macro relies on the `proxy_action` field being present in the event. If that field is not extracted prior to the macro's execution, the `case` function cannot evaluate it, resulting in the default 'unknown' value. To resolve this, ensure that field extraction for `proxy_action` occurs before the macro is applied, either in the base search or within the macro itself. This is essential for correct CIM normalization.

Answer

The `case` function requires a numeric field for comparison.

Answer

The `case` function syntax is incorrect; it should use `if` instead.

Answer

The macro does not include the `index=` or `sourcetype=` to filter events.

Question 13

A Splunk administrator is reviewing how the Common Information Model enables cross-vendor reporting. Which two statements correctly describe how CIM data model acceleration and field aliasing work together? (Choose two.)

Accepted Answer

Field aliases map vendor-specific field names to CIM-standard field names so a single search can match data from multiple sources.. The Common Information Model depends on two complementary mechanisms. Field aliases normalize vendor-specific field names into standard CIM names at search time, enabling one search to span multiple sources. Data model acceleration precomputes summaries so queries against the model avoid scanning raw events. Together they deliver portable, high-performance reporting across heterogeneous data, and neither one requires reindexing or deletes source events.

Answer

Data model acceleration permanently removes the original raw events to save storage once the summary is built.

Answer

Accelerating a data model automatically creates field aliases for every sourcetype that contributes events to that model.

Answer

Field aliases are evaluated only at index time, so adding a new alias requires reindexing the affected data.

Question 14

A Splunk administrator wants to ensure that a saved search runs only on weekdays at 8:00 AM. Which cron expression should be used in the saved search schedule?

Accepted Answer

0 8 * * 1-5. The correct cron expression for weekdays at 8:00 AM is `0 8 * * 1-5`. This specifies minute 0, hour 8, any day of month, any month, and days 1 through 5 (Monday to Friday). This ensures the saved search runs only on weekdays at the desired time.

Answer

8 0 * * 1-5

Answer

0 8 * * 0-4

Answer

0 8 * * 6-7

Question 15

A Splunk Power User is asked to add a new data source to an existing CIM-compliant app so that its events populate the Authentication data model. The sourcetype has fields `user`, `src`, and `action`, but the events are not appearing in the data model. Which two actions are required to make the events appear? (Choose two.)

Accepted Answer

Map the sourcetype's fields to the CIM field names using field aliases or calculated fields in props.conf.. CIM data models choose their events with tags and expect normalized field names. The new source needs an event type or tag definition that applies the Authentication tag, plus field aliases or calculated fields that translate the source's field names to CIM names. Once both are configured, the model and any accelerated summaries can pick up the events without reindexing.

Answer

Reindex the source data so the data model acceleration files are regenerated with the new sourcetype included.

Answer

Convert the source's event timestamps to epoch format so the data model's time constraints can match the events.

Answer

Add the sourcetype to the `[cim_authentication]` stanza in indexes.conf so the indexer routes events to the model.