SPLK-1002 Macros, Saved Searches and CIM Practice Question
A Splunk administrator notices that a scheduled saved search titled 'Nightly_Threat_Report' is not completing on time. The search runs at 2:00 AM daily and typically takes 15 minutes, but recently it has been timing out after 30 minutes. The search query is complex, joining data from multiple indexes. The administrator checks the 'savedsearch.log' and sees entries like 'Search job terminated due to dispatch time limit' and 'Search job exceeded max time'. The administrator wants to resolve the issue without changing the search logic or increasing system resource limits. Which action should the administrator take first?
⚠ Common exam trap
Watch out — candidates often confuse 'dispatch.max_time' (execution timeout) with 'dispatch.earliest_time'/'dispatch.latest_time' (time range), leading them to incorrectly adjust the search window instead of the timeout limit.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Increase the 'dispatch.max_time' parameter for the saved search in savedsearches.conf.
The error messages 'Search job terminated due to dispatch time limit' and 'Search job exceeded max time' directly indicate that the search is hitting the 'dispatch.max_time' limit, which defaults to 600 seconds (10 minutes) for scheduled searches. Increasing this parameter in savedsearches.conf extends the maximum execution time allowed for the search job, allowing the complex query to complete without changing the search logic or system resource limits.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change the scheduled time to 1:00 AM to avoid other concurrent heavy searches.
Why it's wrong here
May help but does not address the dispatch time limit directly.
- ✓
Increase the 'dispatch.max_time' parameter for the saved search in savedsearches.conf.
Why this is correct
This directly increases the dispatch time limit, allowing the search to complete.
- ✗
Increase the 'dispatch.earliest_time' and 'dispatch.latest_time' settings for the saved search to allow a longer execution window.
Why it's wrong here
Those settings control the time range of data searched, not the execution time limit.
- ✗
Reduce the search time range from 'last 24 hours' to 'last 1 hour' to speed up the query.
Why it's wrong here
Changes the data scope; results may not be as intended.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1002 question from scratch — 475 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.