SPLK-1002 Macros, Saved Searches and CIM Practice Question
A user wants to create a macro that calculates the average response time for web requests. The macro should accept a field name as an argument and return the average. Which syntax is correct for defining the macro?
⚠ Common exam trap
Many exam-takers confuse macro argument syntax with eval variable syntax (e.g., `$result$`) or incorrectly assume that the macro definition must be quoted, leading them to pick options A or B, while the correct syntax uses unquoted search commands with `$argname$` placeholders.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
`stats avg($field$) as avg_response`
In Splunk macro definitions, the argument placeholder syntax is `$field$` (with dollar signs), and the macro body must be a valid search string. The `stats avg($field$) as avg_response` correctly uses the argument in a stats command and assigns a static alias, which is the standard way to return a single computed value from a macro. Option C is wrong because although it uses valid syntax with `$field$`, it creates a dynamic alias (`avg_$field$`) which is not appropriate for a macro that needs to return a fixed field name for the average. The requirement is to return the average, so a static alias like `avg_response` is correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
`stats avg($field$) | eval avg_response=$result$`
Why it's wrong here
Incorrect because `$result$` is not a valid macro placeholder; macros use `$argname$` (e.g., `$field$`). Also, the `eval` command is unnecessary and incorrect.
- ✗
"stats avg($field$) as avg_response"
Why it's wrong here
Incorrect because macro definitions must not be enclosed in quotes; they are plain text search strings without surrounding quotes.
- ✗
`stats avg($field$) as avg_$field$`
Why it's wrong here
Incorrect because although `$field$` is a valid placeholder, the dynamic alias `avg_$field$` changes the output field name based on the argument, which is not appropriate for a macro that should return a fixed field name like `avg_response`.
- ✓
`stats avg($field$) as avg_response`
Why this is correct
Correct because it uses the proper syntax: `stats avg($field$) as avg_response` with the argument placeholder `$field$` and a static alias `avg_response`, which is the standard way to return a single computed value from a macro.
Go deeper
Related to this question
About these practice questions
This SPLK-1002 question is part of Courseiva's 475-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.