Troubleshooting Macros in Saved Searches: Understanding App Context
A user defined a macro that includes a lookup command. The macro works correctly in ad-hoc searches. However, when the macro is used in a scheduled saved search, the macro fails to expand. Administration confirms the macro is shared globally. What is the most likely cause of this failure?
Quick Answer
The key detail in this scenario is that the macro's global sharing setting and its dependencies are two separate things. Sharing a macro globally only makes the macro definition itself available everywhere; it says nothing about whether every object the macro references, like a lookup, is also accessible in the app context where the macro actually runs. Ad-hoc searches run in the context of the user's currently selected app, and if that user's context happens to include access to the lookup, the macro expands and works fine. A scheduled saved search, however, runs in the app context of wherever that saved search itself is defined, which may be a different app than the one the user was working in interactively. If the lookup lives in an app that isn't shared to the saved search's app context, the lookup call inside the macro fails at schedule time even though nothing about the macro or the search syntax changed. This is why the other explanations don't fit: a macro argument problem or a syntax error would break ad-hoc use too, and administration already confirmed global sharing. When a knowledge object works ad-hoc but fails only on a schedule, think about app context and permissions for everything that object depends on, not just the object itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The lookup used in the macro is not accessible in the saved search's app context.
Scheduled saved searches run under the context of the app where the saved search is defined. Even though the macro itself is shared globally, any commands or lookups used within the macro must be accessible in that app context. If the lookup used in the macro is defined in a different app and not shared to the saved search's app, the macro will fail at schedule time while working in ad-hoc searches where the user has access to the lookup. Therefore, option B is correct. Option A is unlikely because macro arguments would cause failure in ad-hoc as well. Option C is false as administration confirmed the macro is shared globally. Option D is incorrect because a syntax error would also manifest in ad-hoc searches.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The macro expects arguments that are not provided in the saved search.
Why it's wrong here
If the macro works ad-hoc, arguments are likely provided correctly.
- ✓
The lookup used in the macro is not accessible in the saved search's app context.
Why this is correct
All knowledge objects used in the macro must be accessible from the saved search's app context.
- ✗
The macro is not shared to the global context despite confirmation.
Why it's wrong here
The question states it is shared globally.
- ✗
The macro contains a syntax error that only appears at schedule time.
Why it's wrong here
If the macro works ad-hoc, there is no syntax error.
Go deeper
Related to this question
About these practice questions
One of 475 original SPLK-1002 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SPLK-1002
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. GlobalTech runs Splunk Enterprise Security with CIM compliance. Their security operations center uses a scheduled saved search named 'Brute Force Detection' that runs every 30 minutes. The search definition is: `| tstats count from datamodel=Authentication where Authentication.action=failure by Authentication.user, Authentication.src | where count > 5 | join type=outer user [search index=* sourcetype=linux_secure | stats count by user | where count > 5]`. This search has been working for months. Recently, after an upgrade to the Splunk environment, the saved search started returning no results. The administrator checks the search log and sees that the tstats portion runs fine but the secondary search (the subsearch) returns no events even though there are matching events in the index. The subsearch uses a macro named 'get_failed_users' defined as `search index=* sourcetype=linux_secure "Failed password" | stats count by user | where count>5` with no arguments. The administrator confirms that the macro's search works when run manually in the same time range. What is the most likely reason the subsearch returns no results?
hard- A.The subsearch is not part of the data model acceleration and is limited by the time range of the main search.
- ✓ B.The macro 'get_failed_users' is not defined in the same app context as the saved search.
- C.The subsearch uses a macro, and macros cannot be used in subsearches.
- D.The macro definition has a typo in the search command.
Why B: Macros are resolved in the context of the app where the saved search is defined. If the macro 'get_failed_users' is not defined in the same app context as the 'Brute Force Detection' saved search, the subsearch will fail to resolve the macro and return no results, even though the macro works when run manually in a different app context. Splunk's macro resolution depends on the app context of the search, not the user's current app.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.