SPLK-1002 Macros, Saved Searches and CIM Practice Question
A Splunk administrator uses a macro to normalize firewall logs into the CIM Network Traffic data model. The macro includes a field alias that maps `bytes_sent` to `bytes_out`. The mapping works in ad-hoc searches, but when the macro is used in a summary index search, the field is not populated. What is the most likely reason?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The alias creates a new field that is not included in the summary index output.
The macro applies the field alias at search time, but summary index searches store the results of the search output. Since the alias field `bytes_out` is derived from `bytes_sent` and not a native field in the data, it is not automatically included in the summary index unless explicitly referenced in the search output. Therefore, the field is not populated in the summary index, making option A the correct answer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The alias creates a new field that is not included in the summary index output.
Why this is correct
Search-time aliases create new fields; if the summary index only stores original fields, the aliased field may not be stored unless explicitly kept.
- ✗
The summary index is accelerated and overrides the alias.
Why it's wrong here
Acceleration does not affect field aliases.
- ✗
Field aliases are not supported in macros.
Why it's wrong here
Field aliases are supported in macros.
- ✗
The macro is not shared to the global context, so it fails in summary indexing.
Why it's wrong here
If it works ad-hoc, it is accessible; summary indexing runs in the same context.
Go deeper
Related to this question
About these practice questions
One of 475 original SPLK-1002 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.