SPLK-1002 Macros, Saved Searches and CIM — Timed 25 Questions

Question 1

An admin created a macro `myfilter(host)` with definition: `host=$host$ | stats count`. When calling `myfilter(webserver)`, the search returns no results. What is the most likely cause?

Accepted Answer

The macro argument is not being treated as a literal string.. The macro definition uses `host=$host$` without enclosing `$host$` in double quotes. When `myfilter(webserver)` is called, the expansion becomes `host=webserver | stats count`. Because the argument is not quoted, Splunk treats `webserver` as a raw literal string value for the `host` field—this should match events with `host=webserver`. However, the key point is that the macro argument should be quoted to guarantee it is treated as a literal string. In this scenario, the lack of quotes does not inherently cause the search to return no results unless the actual host values differ. The correct answer is B because the macro argument is not being treated as a literal string (i.e., it is not quoted), and this is the most likely cause of the issue when considering best practices. The reasoning is that if the argument contained special characters, it would break the search, and even for simple values, the macro expects quoted arguments to avoid misinterpretation.

Answer

The host field is case-sensitive.

Answer

The host field is not indexed.

Answer

The macro is evaluated before the rest of the search.

Question 2

What is the most likely cause of the error?

Accepted Answer

The macro name in the definition contains an invalid character (backtick).. The error is most likely due to the backtick character in the macro definition name. In Splunk, macro names must consist only of alphanumeric characters and underscores; backticks are invalid and cause a parsing error. Option A is incorrect because the stem does not indicate whether positional or named arguments are used; the error is about the macro name itself. Option C is incorrect because a missing parenthesis would cause a syntax error, but the backtick is a more specific issue. Option D repeats the confusion of option A; the error is not about argument syntax but about the name containing an invalid character.

Answer

The macro definition uses positional arguments but the call uses named arguments.

Answer

The macro call is missing a closing parenthesis.

Answer

The macro call uses named arguments instead of positional arguments.

Question 3

Which TWO of the following are valid considerations when defining macros in Splunk?

Accepted Answer

Macros can be imported from other apps if they are shared globally.. Correct answers: A and D. Macros must be defined with a unique name within an app (A), and macros can be imported from other apps if shared globally (D). Option B is false because macros can accept multiple arguments. Option C is false because macro definition is done in configuration files, not in the search bar. Option E is not a requirement; macros can contain any commands.

Answer

Macros cannot contain transforming commands.

Answer

Macros can only accept a single argument.

Answer

Macro definitions can be created directly in the search bar.

Question 4

An administrator configures a saved search that uses a macro to generate a summary index every hour. The macro includes a time range argument with default value `earliest=-1h@h latest=@h`. The saved search does not pass any time range argument, so the default is used. After a few days, the summary index is missing data for the last hour of each day. What is the most likely cause?

Accepted Answer

The macro definition used a static time range (e.g., `earliest=08:00:00 latest=09:00:00`) instead of a relative one.. If the macro definition uses a static time range (e.g., `earliest=08:00:00 latest=09:00:00`), it will always summarize data from that specific fixed hour regardless of when the search runs. Since the saved search runs every hour using the macro's default, it repeatedly summarizes the same hour (e.g., 08:00-09:00) and never covers the last hour of the day (e.g., 23:00-00:00). This causes missing data for the final hour of each day. Relative time ranges like `earliest=-1h@h` adjust to the current time and cover the most recent completed hour, avoiding such gaps.

Answer

The saved search schedule is set to run on the hour, but the macro's default time range covers the previous hour, creating an overlap.

Answer

The macro is defined in a private app, and the saved search runs in a different app, causing the macro default not to be used.

Answer

The saved search's summary index is configured with a summary range that is too short, causing old data to be aged out.

Question 5

Which THREE of the following are valid ways to define macro arguments in Splunk? (Select exactly 2.)

Accepted Answer

Defining arguments list in `args` field: `args = arg1, arg2`. In Splunk, macro arguments can be defined in several ways. Option C is correct: listing arguments in the `args` field (e.g., `args = arg1, arg2`) defines named arguments that can be referenced as `$arg1$`, `$arg2$`. Option D is correct: using `$arg$=default$` syntax defines a named argument with a default value. Option E is correct: using positional numeric arguments like `$1$`, `$2$` also defines macro arguments, referenced by position. Option A is incorrect because `$arg$` without a default value is not a valid definition; a default must be provided. Option B is incorrect because `eval` is not used to define arguments; arguments are defined in the macro definition itself.

Answer

`$arg$` without default

Answer

Using `| eval` to set argument values inside the macro

Question 6

An engineer wants to create a saved search that runs every hour and searches against 90 days of data. To optimize performance, they should...

Accepted Answer

Use a summary index to pre-compute results.. To optimize a saved search that runs every hour against 90 days of data, using a summary index is the best choice. Summary indexing pre-computes aggregated results and stores them in an index, which can be quickly retrieved each hour without re-scanning the full 90 days. Report acceleration (option D) also pre-computes results but is less efficient for such a large time range because it must maintain acceleration over 90 days. Option B (relative time range) is already implicit in the search. Option C (| stats with span) is a search technique and does not inherently optimize performance for repeated searches.

Answer

Set a time range relative to the search time.

Answer

Use the `| stats` command with `span` to aggregate.

Answer

Enable report acceleration on the saved search.

Question 7

Refer to the exhibit. An analyst executes the following search: `| filter_status(status_code=500)`. What will be the result?

Accepted Answer

The macro will fail because named arguments are not supported; Splunk macro arguments are positional.. The macro `filter_status` is defined with positional arguments (e.g., `$arg1$`), but the call `filter_status(status_code=500)` uses named argument syntax (`name=value`). Splunk macros only support named arguments if they are explicitly defined with `args = =` in the macro definition. Since this macro does not have such a definition, the named argument is not recognized, causing the macro to fail. The error occurs because Splunk cannot map `status_code=500` to the positional placeholder `$arg1$`.

Answer

The macro will run successfully, but it will use the literal string "status_code=500" as the argument value.

Answer

The macro will fail because the argument definition uses $arg1$ but the macro was called with "status_code=500".

Answer

The macro will run successfully, returning count of events with status=500.

Question 8

A security analyst wants to create a macro that extracts IP addresses from a field named `src_ip` and returns a count of unique IPs per source. Which macro definition accomplishes this?

Accepted Answer

| stats dc(src_ip) as unique_ips. `dc(src_ip)` is the Splunk command for distinct count, which returns the number of unique IP addresses in the `src_ip` field. This macro definition directly fulfills the requirement to count unique IPs per source, as `dc` is the standard abbreviation for distinct count in Splunk's `stats` command.

Answer

| stats count(src_ip) as unique_ips

Answer

| stats distinct_count(src_ip) as unique_ips

Answer

| stats unique(src_ip) as unique_ips

Question 9

A team regularly runs a saved search that joins two large indexes. Performance is poor. Which design change would MOST improve query performance?

Accepted Answer

Create a data model summary to pre-aggregate the data.. A data model summary pre-aggregates data at search time, reducing the volume of data that the join operation must process. This is the most effective way to improve performance when joining two large indexes, as it avoids scanning and joining raw events repeatedly.

Answer

Convert the saved search to a scheduled report.

Answer

Replace the join with a subsearch.

Answer

Use the `fields` command to remove unnecessary fields before the join.

Question 10

Which TWO of the following are valid uses of the Common Information Model (CIM) in Splunk?

Accepted Answer

Defining tags and event types to categorize data.. The CIM provides a standardized set of tags and event types that allow you to categorize and classify data from diverse sources, enabling consistent searching and correlation across your Splunk environment. Option E is correct because the CIM defines common field names (e.g., src_ip, dest_ip, user) to normalize data from different technologies, ensuring that searches and dashboards work uniformly regardless of the original data source.

Answer

Defining user roles and permissions for data access.

Answer

Managing license usage across indexers.

Answer

Creating new indexes for faster search performance.

Question 11

Which THREE of the following are best practices for creating saved searches?

Accepted Answer

Set an appropriate time range to limit the data scanned.. Setting an appropriate time range in a saved search limits the volume of data that Splunk must scan, reducing resource consumption and improving search performance. Without a bounded time range, the search may scan all available data, which can lead to excessive CPU and memory usage, especially in large deployments.

Answer

Save the search without scheduling it to avoid resource usage.

Answer

Avoid specifying a time range to use the default.

Question 12

Which TWO of the following are valid ways to reference a macro in a search?

Accepted Answer

`macro_name(arg1, arg2)`. In Splunk, a macro is invoked using backticks with parentheses around its arguments, as in `macro_name(arg1, arg2)`. This syntax tells the search processor to expand the macro definition with the provided arguments before executing the search.

Answer

$macro_name(arg1, arg2)$

Answer

macro_name:arg1, arg2

Answer

| macro_name(arg1, arg2)

Question 13

A Splunk administrator notices that a scheduled saved search `Daily Summary` fails every day at 2:00 AM with the error "Search job expired due to inactivity." The search runs against a large index and takes about 30 minutes to complete. What is the most likely cause?

Accepted Answer

The scheduled search is configured with a time limit shorter than 30 minutes.. The error 'Search job expired due to inactivity' indicates that the scheduled search was terminated before it could complete. In Splunk, saved searches have a configurable time limit (default 10 minutes) that specifies the maximum runtime before the search is killed. Since the search takes 30 minutes, the time limit must be set to less than 30 minutes, causing the premature termination.

Answer

The user who owns the saved search does not have permissions to run it at that time.

Answer

The indexer has reached its license quota and stops processing.

Answer

The search is consuming too much disk space.

Question 14

A security analyst wants to create a saved search that triggers an alert when more than 100 failed login attempts occur within a 5-minute window from the same source IP. The search should run every 5 minutes and alert only once per window. Which setting should be configured?

Accepted Answer

Enable 'Throttle' and set the throttle window to 5 minutes, throttling on the source IP field.. Enabling Throttle with a 5-minute window on the source IP field ensures that once an alert fires for a given source IP, subsequent alerts from that same IP are suppressed for the duration of the throttle window. This matches the requirement to alert only once per 5-minute window per source IP, preventing alert fatigue while still detecting the threshold breach.

Answer

Enable 'Digest mode' with a time window of 5 minutes.

Answer

Configure the search to use a 'Real-time' window of 5 minutes and set 'Alert on' to 'Result count'.

Answer

Set the 'Alert condition' to 'Number of results > 100' and use a rolling time window of 5 minutes.

Question 15

A Splunk admin wants to create a macro that extracts the username from a log line that always starts with 'User: <username>'. The macro should be reusable across searches. Which definition is correct?

Accepted Answer

`rex field=_raw "User: (?\S+)"`. The `rex` command with `field=_raw` and a named capturing group `(?\S+)` extracts the username into a field called `username`. This is the standard Splunk way to perform regex extraction in a search, and wrapping it in a macro makes it reusable across searches without additional syntax.

Answer

`eval username=extract("User: (?<username>\S+)")`

Answer

`rex field=_raw "User: (?<username>\S+)" | eval username=$result$`

Answer

`username = rex field=_raw "User: (?<username>\S+)"`

Question 16

An organization uses Splunk CIM to normalize data from multiple sources. They have a custom data source that logs firewall events with a field 'action' containing values 'accept', 'deny', 'drop'. They want to map this to the CIM field 'action'. Which configuration is required?

Accepted Answer

Define a field alias in props.conf: `FIELDALIAS-action = action as action`. The CIM field 'action' already exists in the CIM data model with the same name as the vendor field. A field alias in props.conf using `FIELDALIAS-action = action as action` simply creates an alias so that the vendor's 'action' field is recognized as the CIM 'action' field, allowing the CIM to normalize the data without any transformation. This is the simplest and most efficient method when the vendor field name and values already match the CIM field name and expected values.

Answer

Use the 'calculatedfields' field in props.conf: `CALCULATED_action = if(action=="accept","allowed",if(action=="deny","blocked","dropped"))`

Answer

Create a custom data model that includes the field 'action' with the vendor values.

Answer

Add a tag 'action=accept' to events with action=accept, and similarly for deny and drop.

Question 17

A Splunk admin notices that a saved search scheduled to run every 10 minutes is consistently taking 15 minutes to complete, causing overlapping runs. The search aggregates data across multiple indexes and uses a large time window. What is the best way to prevent overlap and ensure the search completes?

Accepted Answer

Configure the search to 'Skip the next scheduled run if the previous run is still in progress'.. The 'Skip the next scheduled run if the previous run is still in progress' setting is specifically designed to prevent overlapping executions of a saved search. This ensures that if a search takes longer than its scheduled interval, the next scheduled run is skipped, avoiding resource contention and incomplete results.

Answer

Set the search to 'Run on a timer' and increase the schedule interval to 20 minutes.

Answer

Enable the 'Schedule Priority' setting to 'Higher' and set 'Schedule Window' to 0.

Answer

Reduce the search time window to 5 minutes to decrease execution time.

Question 18

Which TWO of the following are valid ways to create a macro in Splunk? (choose two)

Accepted Answer

Navigate to Settings > Advanced search > Search macros and click 'New'.. Splunk provides a GUI-based method to create macros via Settings > Advanced search > Search macros, which is a standard and supported approach. Option D is correct because manually creating a macros.conf file in $SPLUNK_HOME/etc/system/local/ is a valid configuration method that Splunk reads at startup to define macros.

Answer

Add a macro definition to props.conf under a [source] stanza.

Answer

Use the CLI command `splunk add macro` with the macro definition.

Answer

Edit the macros.conf file in the app's default directory.

Question 19

Which THREE of the following are components of the Splunk Common Information Model (CIM)? (choose three)

Accepted Answer

Endpoint. (Endpoint) is correct because the Splunk Common Information Model (CIM) includes the Endpoint data model, which normalizes data from endpoint security solutions such as antivirus, EDR, and host-based intrusion detection. This data model covers processes, file system changes, registry modifications, and other host-level activities, making it a core component of the CIM.

Answer

Application State

Answer

Change Analysis

Question 20

A user wants to create a macro that calculates the average response time for web requests. The macro should accept a field name as an argument and return the average. Which syntax is correct for defining the macro?

Accepted Answer

`stats avg($field$) as avg_response`. In Splunk macro definitions, the argument placeholder syntax is `$field$` (with dollar signs), and the macro body must be a valid search string. The `stats avg($field$) as avg_response` correctly uses the argument in a stats command and assigns a static alias, which is the standard way to return a single computed value from a macro. Option C is wrong because although it uses valid syntax with `$field$`, it creates a dynamic alias (`avg_$field$`) which is not appropriate for a macro that needs to return a fixed field name for the average. The requirement is to return the average, so a static alias like `avg_response` is correct.

Answer

`stats avg($field$) | eval avg_response=$result$`

Answer

"stats avg($field$) as avg_response"

Answer

`stats avg($field$) as avg_$field$`