SPLK-1002 Macros, Saved Searches and CIM Practice Question
A Splunk admin is tasked with creating a set of macros that will be used by multiple app developers to standardize searches across the organization. The macros need to accept parameters such as index, sourcetype, and time range. Some macros will be complex and include subsearches. Which approach should the admin take to ensure maximum reusability and maintainability?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use macro arguments with default values and include comments in the definition.
Using macro arguments with default values and comments provides flexibility and clarity. Defining macros without arguments forces users to edit for each use. Separate macros for each parameter combination create unnecessary duplication. A single macro with conditionals becomes complex and hard to maintain.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create separate macros for each combination of parameters.
Why it's wrong here
This leads to explosion of macros and duplication.
- ✗
Embed all logic into a single macro and use conditional statements.
Why it's wrong here
A single macro with conditionals is complex and less reusable.
- ✓
Use macro arguments with default values and include comments in the definition.
Why this is correct
Correct: Arguments with defaults allow flexible use, and comments improve maintainability.
- ✗
Define macros with no arguments and rely on the developers to modify the macro code.
Why it's wrong here
This defeats reusability and increases maintenance burden.
Go deeper
Related to this question
About these practice questions
One of 475 original SPLK-1002 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SPLK-1002
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A Splunk administrator wants to create a reusable search component that accepts a sourcetype and a time range. What is the correct method to define this in Splunk?
easy- A.Create a saved search that uses tokens to parameterize the query.
- B.Use an eval statement to define a variable that holds the query.
- ✓ C.Define a macro with arguments using backticks and $arg$ syntax.
- D.Use a lookup definition with parameters to filter results.
Why C: The correct method is to define a macro with arguments using backticks and $arg$ syntax (Option C). Macros are designed for reusable search components that can accept parameters. Option A (saved search with tokens) is typically used in dashboards to pass values at runtime, not for creating reusable search fragments. Option B (eval statement) defines a variable but does not create a reusable search component. Option D (lookup definition) is used for enriching events with external data, not for defining search logic.
Variation 2. A Splunk administrator wants to reduce maintenance effort when the same search logic is used in multiple saved searches. Which approach is most effective?
easy- ✓ A.Define a macro that encapsulates the common search logic and reference the macro in each saved search.
- B.Use the Common Information Model (CIM) to normalize the data and then search using data model commands.
- C.Create a summary index that contains the output of the common logic and have each saved search reference that summary index.
- D.Enable report acceleration on each saved search to improve performance.
Why A: Defining a macro allows you to encapsulate the common search logic in one place and reference it in multiple saved searches. This reduces duplication and maintenance effort, as changes only need to be made in the macro definition. Option B (CIM) normalizes data but does not directly reduce maintenance of repeated search logic. Option C (summary index) adds complexity and requires additional processing steps, which increases maintenance burden. Option D (report acceleration) improves performance but does not address reuse of search logic.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.