A large organization uses Splunk to monitor its network infrastructure. They have a single saved search that runs every hour to create a summary index for each of the 50 network device sourcetypes. The saved search uses a macro named `build_network_summary` that accepts two arguments: `sourcetype` and `time_range`. The macro definition is:

```
[build_network_summary]
definition = index=network sourcetype=$sourcetype$ earliest=$time_range$ latest=now | stats count by src_ip, dest_ip, protocol | collect index=network_summary
args = sourcetype, time_range
iseval = 0
```

The saved search iterates over the 50 sourcetypes using a separate lookup or list. Recently, the security team noticed that the network_summary index is missing data for certain sourcetypes, specifically those with hyphens in their names (e.g., `cisco-asa`, `juniper-srx`). For other sourcetypes, the summary is complete. The saved search runs without errors in Splunk's job inspector. Which course of action should the administrator take to resolve the issue?

Question

A large organization uses Splunk to monitor its network infrastructure. They have a single saved search that runs every hour to create a summary index for each of the 50 network device sourcetypes. The saved search uses a macro named `build_network_summary` that accepts two arguments: `sourcetype` and `time_range`. The macro definition is:

```
[build_network_summary]
definition = index=network sourcetype=$sourcetype$ earliest=$time_range$ latest=now | stats count by src_ip, dest_ip, protocol | collect index=network_summary
args = sourcetype, time_range
iseval = 0
```

The saved search iterates over the 50 sourcetypes using a separate lookup or list. Recently, the security team noticed that the network_summary index is missing data for certain sourcetypes, specifically those with hyphens in their names (e.g., `cisco-asa`, `juniper-srx`). For other sourcetypes, the summary is complete. The saved search runs without errors in Splunk's job inspector. Which course of action should the administrator take to resolve the issue?

Accepted Answer

Modify the macro definition to enclose the `$sourcetype$` argument in quotation marks: `sourcetype="$sourcetype$"`. When a macro argument contains special characters like hyphens, Splunk may misinterpret them as operators (e.g., subtraction) or search syntax modifiers. Enclosing the `$sourcetype$` argument in quotation marks, i.e., `sourcetype="$sourcetype$"`, ensures the entire value is treated as a literal string, preventing parsing errors for sourcetypes with hyphens. Option A is incorrect because increasing the index range doesn't address the parsing issue. Option C is unrelated to the sourcetype name problem. Option D is irrelevant as acceleration does not fix data ingestion or search syntax issues.

Answer

Increase the summary index range to cover all sourcetypes in one pass rather than iterating.

Answer

Change the macro's time_range argument to use a static time range to avoid relative time issues.

Answer

Enable acceleration on the network_summary index to improve data completeness.

SPLK-1002 Macros, Saved Searches and CIM Practice Question

Why each option matters

Option-by-option breakdown

Related to this question