SPLK-1002 Macros, Saved Searches and CIM Practice Question
A saved search alert is configured to run every 10 minutes and trigger when the count of error events exceeds 5. The search returns results when run manually, but the alert never triggers. The admin checks the alert history and sees entries for the previous runs but all show 'Trigger: False'. They also confirm that the search returns count > 5 for those periods. What is the likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The alert condition is set to 'when number of results is greater than 5' but it should be 'when count field is greater than 5'.
The alert is configured to trigger when the number of results is greater than 5, but the search likely returns a single result with a count field (e.g., using `stats count`). The alert condition evaluates the number of results, not the value of the count field, so even when the count exceeds 5, the number of results is still 1, causing the alert not to trigger. Therefore, the correct fix is to change the condition to 'when count field is greater than 5' (Option D). Option A is incorrect because throttling would suppress alerts after a trigger, not prevent them from triggering. Option B is incorrect because summary indexes are searchable by alerts. Option C is incorrect because the admin confirmed the counts from manual runs match the periods, indicating the time range is correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The alert is disabled due to throttling or suppression settings.
Why it's wrong here
Throttling only suppresses after a trigger; since no trigger occurred, this is not the cause.
- ✗
The search uses a summary index that is not searchable by the alert system.
Why it's wrong here
Alerts can search any index; this is not a typical limitation.
- ✗
The time range in the saved search does not align with the alert schedule.
Why it's wrong here
Time range alignment is standard; the admin confirmed that manual results match alert periods.
- ✓
The alert condition is set to 'when number of results is greater than 5' but it should be 'when count field is greater than 5'.
Why this is correct
Correct: The condition must evaluate the count field value, not the number of results.
Go deeper
Related to this question
About these practice questions
One of 475 original SPLK-1002 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.