SPLK-1002 Macros, Saved Searches and CIM Practice Question
A Splunk admin created a macro named `filter_by_region` that takes one argument: the region code. The macro definition is: `index=main sourcetype=web region=$region$`. When a user runs the search `| `filter_by_region US`` they get no results, but when they replace the macro with the actual string `index=main sourcetype=web region=US`, they get results. What is the problem?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The macro definition does not specify an argument list.
The macro definition does not include an argument list, so `$region$` is treated as literal text. The correct definition should be `filter_by_region(region)` in the definition name. Double dollar signs are correct for variable expansion. Quotation marks are not an issue here. Permissions would cause an error message.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The macro definition does not specify an argument list.
Why this is correct
Correct: Without an argument list, the macro does not recognize `$region$` as a variable.
- ✗
The macro argument is not passed correctly because of quotation marks.
Why it's wrong here
Quotation marks are not used in this scenario; the argument is passed directly.
- ✗
The user does not have execute permissions for the macro.
Why it's wrong here
Permission issues would produce an error, not just empty results.
- ✗
The macro uses double dollar signs incorrectly; it should be `$region$`.
Why it's wrong here
Double dollar signs are the correct syntax for macro argument references.
Go deeper
Related to this question
About these practice questions
One of 475 original SPLK-1002 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SPLK-1002
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An admin created a macro `myfilter(host)` with definition: `host=$host$ | stats count`. When calling `myfilter(webserver)`, the search returns no results. What is the most likely cause?
hard- A.The host field is case-sensitive.
- ✓ B.The macro argument is not being treated as a literal string.
- C.The host field is not indexed.
- D.The macro is evaluated before the rest of the search.
Why B: The macro definition uses `host=$host$` without enclosing `$host$` in double quotes. When `myfilter(webserver)` is called, the expansion becomes `host=webserver | stats count`. Because the argument is not quoted, Splunk treats `webserver` as a raw literal string value for the `host` field—this should match events with `host=webserver`. However, the key point is that the macro argument should be quoted to guarantee it is treated as a literal string. In this scenario, the lack of quotes does not inherently cause the search to return no results unless the actual host values differ. The correct answer is B because the macro argument is not being treated as a literal string (i.e., it is not quoted), and this is the most likely cause of the issue when considering best practices. The reasoning is that if the argument contained special characters, it would break the search, and even for simple values, the macro expects quoted arguments to avoid misinterpretation.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.