SPLK-1003 Macros, Saved Searches and CIM — Timed 15 Questions

Question 1

A security analyst wants to create a macro that extracts IP addresses from a field named `src_ip` and returns a count of unique IPs per source. Which macro definition accomplishes this?

Accepted Answer

| stats dc(src_ip) as unique_ips. Option D is correct because `dc(src_ip)` is the Splunk command for distinct count, which returns the number of unique IP addresses in the `src_ip` field. This macro definition directly fulfills the requirement to count unique IPs per source, as `dc` is the standard abbreviation for distinct count in Splunk's `stats` command.

Answer

| stats count(src_ip) as unique_ips

Answer

| stats distinct_count(src_ip) as unique_ips

Answer

| stats unique(src_ip) as unique_ips

Question 2

A team regularly runs a saved search that joins two large indexes. Performance is poor. Which design change would MOST improve query performance?

Accepted Answer

Create a data model summary to pre-aggregate the data.. Option B is correct because a data model summary pre-aggregates data at search time, reducing the volume of data that the join operation must process. This is the most effective way to improve performance when joining two large indexes, as it avoids scanning and joining raw events repeatedly.

Answer

Convert the saved search to a scheduled report.

Answer

Replace the join with a subsearch.

Answer

Use the `fields` command to remove unnecessary fields before the join.

Question 3

An admin created a macro `myfilter(host)` with definition: `host=$host$ | stats count`. When calling `myfilter(webserver)`, the search returns no results. What is the most likely cause?

Accepted Answer

The macro argument is not being treated as a literal string.. The macro definition uses `host=$host$`, but when called with `myfilter(webserver)`, the argument `webserver` is passed as a literal string. However, the macro expands to `host=webserver | stats count`, which Splunk interprets as a field-value comparison where `webserver` is treated as a literal string value for the `host` field. The issue is that the macro argument is not being treated as a literal string in the context of the search; instead, it's being substituted directly, which is correct. The real problem is that the macro definition uses `$host$` without quotes, so the argument is not being treated as a literal string value—it's being interpreted as a field name or search term. The correct syntax should be `host="$host$"` to ensure the argument is treated as a literal string. Option B is correct because the macro argument is not being treated as a literal string, causing the search to fail to match events.

Answer

The host field is case-sensitive.

Answer

The host field is not indexed.

Answer

The macro is evaluated before the rest of the search.

Question 4

Which TWO of the following are valid uses of the Common Information Model (CIM) in Splunk?

Accepted Answer

Defining tags and event types to categorize data.. Option D is correct because the CIM provides a standardized set of tags and event types that allow you to categorize and classify data from diverse sources, enabling consistent searching and correlation across your Splunk environment. Option E is correct because the CIM defines common field names (e.g., src_ip, dest_ip, user) to normalize data from different technologies, ensuring that searches and dashboards work uniformly regardless of the original data source.

Answer

Defining user roles and permissions for data access.

Answer

Managing license usage across indexers.

Answer

Creating new indexes for faster search performance.

Question 5

Which THREE of the following are best practices for creating saved searches?

Accepted Answer

Set an appropriate time range to limit the data scanned.. Option B is correct because setting an appropriate time range in a saved search limits the volume of data that Splunk must scan, reducing resource consumption and improving search performance. Without a bounded time range, the search may scan all available data, which can lead to excessive CPU and memory usage, especially in large deployments.

Answer

Save the search without scheduling it to avoid resource usage.

Answer

Avoid specifying a time range to use the default.

Question 6

Which TWO of the following are valid ways to reference a macro in a search?

Accepted Answer

`macro_name(arg1, arg2)`. Option C is correct because in Splunk, a macro is invoked using backticks with parentheses around its arguments, as in `macro_name(arg1, arg2)`. This syntax tells the search processor to expand the macro definition with the provided arguments before executing the search.

Answer

$macro_name(arg1, arg2)$

Answer

macro_name:arg1, arg2

Answer

| macro_name(arg1, arg2)

Question 7

A Splunk administrator notices that a scheduled saved search `Daily Summary` fails every day at 2:00 AM with the error "Search job expired due to inactivity." The search runs against a large index and takes about 30 minutes to complete. What is the most likely cause?

Accepted Answer

The scheduled search is configured with a time limit shorter than 30 minutes.. The error 'Search job expired due to inactivity' indicates that the scheduled search was terminated before it could complete. In Splunk, saved searches have a configurable time limit (default 10 minutes) that specifies the maximum runtime before the search is killed. Since the search takes 30 minutes, the time limit must be set to less than 30 minutes, causing the premature termination.

Answer

The user who owns the saved search does not have permissions to run it at that time.

Answer

The indexer has reached its license quota and stops processing.

Answer

The search is consuming too much disk space.

Question 8

A security analyst wants to create a saved search that triggers an alert when more than 100 failed login attempts occur within a 5-minute window from the same source IP. The search should run every 5 minutes and alert only once per window. Which setting should be configured?

Accepted Answer

Enable 'Throttle' and set the throttle window to 5 minutes, throttling on the source IP field.. Option D is correct because enabling Throttle with a 5-minute window on the source IP field ensures that once an alert fires for a given source IP, subsequent alerts from that same IP are suppressed for the duration of the throttle window. This matches the requirement to alert only once per 5-minute window per source IP, preventing alert fatigue while still detecting the threshold breach.

Answer

Enable 'Digest mode' with a time window of 5 minutes.

Answer

Configure the search to use a 'Real-time' window of 5 minutes and set 'Alert on' to 'Result count'.

Answer

Set the 'Alert condition' to 'Number of results > 100' and use a rolling time window of 5 minutes.

Question 9

A Splunk admin wants to create a macro that extracts the username from a log line that always starts with 'User: <username>'. The macro should be reusable across searches. Which definition is correct?

Accepted Answer

`rex field=_raw "User: (?\S+)"`. Option A is correct because the `rex` command with `field=_raw` and a named capturing group `(?\S+)` extracts the username into a field called `username`. This is the standard Splunk way to perform regex extraction in a search, and wrapping it in a macro makes it reusable across searches without additional syntax.

Answer

`eval username=extract("User: (?<username>\S+)")`

Answer

`rex field=_raw "User: (?<username>\S+)" | eval username=$result$`

Answer

`username = rex field=_raw "User: (?<username>\S+)"`

Question 10

An organization uses Splunk CIM to normalize data from multiple sources. They have a custom data source that logs firewall events with a field 'action' containing values 'accept', 'deny', 'drop'. They want to map this to the CIM field 'action'. Which configuration is required?

Accepted Answer

Define a field alias in props.conf: `FIELDALIAS-action = action as action`. Option A is correct because the CIM field 'action' already exists in the CIM data model with the same name as the vendor field. A field alias in props.conf using `FIELDALIAS-action = action as action` simply creates an alias so that the vendor's 'action' field is recognized as the CIM 'action' field, allowing the CIM to normalize the data without any transformation. This is the simplest and most efficient method when the vendor field name and values already match the CIM field name and expected values.

Answer

Use the 'calculatedfields' field in props.conf: `CALCULATED_action = if(action=="accept","allowed",if(action=="deny","blocked","dropped"))`

Answer

Create a custom data model that includes the field 'action' with the vendor values.

Answer

Add a tag 'action=accept' to events with action=accept, and similarly for deny and drop.

Question 11

A Splunk admin notices that a saved search scheduled to run every 10 minutes is consistently taking 15 minutes to complete, causing overlapping runs. The search aggregates data across multiple indexes and uses a large time window. What is the best way to prevent overlap and ensure the search completes?

Accepted Answer

Configure the search to 'Skip the next scheduled run if the previous run is still in progress'.. Option D is correct because the 'Skip the next scheduled run if the previous run is still in progress' setting is specifically designed to prevent overlapping executions of a saved search. This ensures that if a search takes longer than its scheduled interval, the next scheduled run is skipped, avoiding resource contention and incomplete results.

Answer

Set the search to 'Run on a timer' and increase the schedule interval to 20 minutes.

Answer

Enable the 'Schedule Priority' setting to 'Higher' and set 'Schedule Window' to 0.

Answer

Reduce the search time window to 5 minutes to decrease execution time.

Question 12

Which TWO of the following are valid ways to create a macro in Splunk? (choose two)

Accepted Answer

Navigate to Settings > Advanced search > Search macros and click 'New'.. Option C is correct because Splunk provides a GUI-based method to create macros via Settings > Advanced search > Search macros, which is a standard and supported approach. Option D is correct because manually creating a macros.conf file in $SPLUNK_HOME/etc/system/local/ is a valid configuration method that Splunk reads at startup to define macros.

Answer

Add a macro definition to props.conf under a [source] stanza.

Answer

Use the CLI command `splunk add macro` with the macro definition.

Answer

Edit the macros.conf file in the app's default directory.

Question 13

Which THREE of the following are components of the Splunk Common Information Model (CIM)? (choose three)

Accepted Answer

Endpoint. Option B (Endpoint) is correct because the Splunk Common Information Model (CIM) includes the Endpoint data model, which normalizes data from endpoint security solutions such as antivirus, EDR, and host-based intrusion detection. This data model covers processes, file system changes, registry modifications, and other host-level activities, making it a core component of the CIM.

Answer

Application State

Answer

Change Analysis

Question 14

A user wants to create a macro that calculates the average response time for web requests. The macro should accept a field name as an argument and return the average. Which syntax is correct for defining the macro?

Accepted Answer

`stats avg($field$) as avg_response`. Option D is correct because in Splunk macro definitions, the argument placeholder syntax is `$field$` (with dollar signs), and the macro body must be a valid search string. The `stats avg($field$) as avg_response` correctly uses the argument in a stats command and assigns a static alias, which is the standard way to return a single computed value from a macro.

Answer

`stats avg($field$) | eval avg_response=$result$`

Answer

"stats avg($field$) as avg_response"

Answer

`stats avg($field$) as avg_$field$`

Question 15

What is the most likely cause of the error?

Accepted Answer

The macro name in the definition contains an invalid character (backtick).. The error is caused by the backtick character in the macro definition name. In Splunk, macro names must consist only of alphanumeric characters and underscores; backticks are invalid and will cause a parsing error when the macro is defined or called.

Answer

The macro definition uses positional arguments but the call uses named arguments.

Answer

The macro call is missing a closing parenthesis.

Answer

The macro call uses named arguments instead of positional arguments.