SPLK-1002 Macros, Saved Searches and CIM Practice Question
A Splunk admin wants to create a reusable macro that accepts a time range parameter and searches all indexes for events within that range. The macro will be used in dashboards and reports. Which macro definition is correct?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
define my_search($timerange$) [search index=* earliest=$timerange$]
Macro definitions use the format `define macro_name($arg$) [definition]`, where arguments are enclosed in dollar signs and the definition is enclosed in square brackets. Option A is incorrect because it uses `$timerange` without closing dollar sign. Option B is incorrect because it lacks the enclosing brackets. Option C is incorrect because it uses angle brackets instead of square brackets. Only option D correctly uses both the argument syntax and brackets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
define my_search($timerange) [search index=* earliest=$timerange]
Why it's wrong here
Argument names must have both prefix and suffix dollar signs (e.g., $timerange$).
- ✗
define my_search($timerange$) search index=* earliest=$timerange$
Why it's wrong here
Macro definitions must be enclosed in square brackets.
- ✗
define my_search($timerange$) <search index=* earliest=$timerange$>
Why it's wrong here
Angle brackets are not used for macro definitions; brackets are required.
- ✓
define my_search($timerange$) [search index=* earliest=$timerange$]
Why this is correct
Correct macro definition with proper argument syntax and brackets.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1002 question from scratch — 475 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SPLK-1002
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. The admin calls the macro as shown. What will be the expanded search string?
medium- ✓ A.search index=main earliest=-1h latest=now | stats count by sourcetype | rename count as total
- B.search index='main' earliest='-1h' latest=now | stats count by sourcetype | rename count as total
- C.search index=-1h earliest=main latest=now | stats count by sourcetype | rename count as total
- D.search index=main|earliest=-1h latest=now | stats count by sourcetype | rename count as total
Why A: Macro arguments are substituted: $index$ becomes 'main', $time_range$ becomes '-1h'. The brackets define the search inside. Option B incorrectly concatenates. Option C uses single quotes. Option D swaps order.
Variation 2. A Splunk admin wants to create a macro named `filter_by_app` that accepts an application name as an argument and returns a search string filtering by that application. The application name may contain spaces. Which of the following correctly defines the macro's arguments and usage?
easy- A.Definition: `filter_by_app(1)` and usage: `index=main app=$1$`
- B.Definition: `filter_by_app($app$)` and usage: `index=main app=$app$`
- ✓ C.Definition: `filter_by_app($app$)` and usage: `index=main app="$app$"`
- D.Definition: `filter_by_app(app)` and usage: `index=main app=app`
- E.Definition: `filter_by_app($1)` and usage: `index=main app=$1`
Why C: Macro arguments must be referenced with $arg$ syntax and when the value contains spaces, it must be quoted. Option A defines the argument numerically (1) and uses $1$ without quotes, which fails for spaces. Option B defines the argument with $app$ (invalid syntax for definition) and uses $app$ without quotes. Option D defines 'app' without dollar signs, so the usage treats 'app' as literal text, not a variable. Option E uses $1 without a trailing dollar sign, which is invalid.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.