GlobalTech runs Splunk Enterprise Security with CIM compliance. Their security operations center uses a scheduled saved search named 'Brute Force Detection' that runs every 30 minutes. The search definition is: `| tstats count from datamodel=Authentication where Authentication.action=failure by Authentication.user, Authentication.src | where count 5 | join type=outer user [search index=* sourcetype=linux_secure | stats count by user | where count 5]`. This search has been working for months. Recently, after an upgrade to the Splunk environment, the saved search started returning no results. The administrator checks the search log and sees that the tstats portion runs fine but the secondary search (the subsearch) returns no events even though there are matching events in the index. The subsearch uses a macro named 'get_failed_users' defined as `search index=* sourcetype=linux_secure "Failed password" | stats count by user | where count5` with no arguments. The administrator confirms that the macro's search works when run manually in the same time range. What is the most likely reason the subsearch returns no results?

Question

GlobalTech runs Splunk Enterprise Security with CIM compliance. Their security operations center uses a scheduled saved search named 'Brute Force Detection' that runs every 30 minutes. The search definition is: `| tstats count from datamodel=Authentication where Authentication.action=failure by Authentication.user, Authentication.src | where count > 5 | join type=outer user [search index=* sourcetype=linux_secure | stats count by user | where count > 5]`. This search has been working for months. Recently, after an upgrade to the Splunk environment, the saved search started returning no results. The administrator checks the search log and sees that the tstats portion runs fine but the secondary search (the subsearch) returns no events even though there are matching events in the index. The subsearch uses a macro named 'get_failed_users' defined as `search index=* sourcetype=linux_secure "Failed password" | stats count by user | where count>5` with no arguments. The administrator confirms that the macro's search works when run manually in the same time range. What is the most likely reason the subsearch returns no results?

Accepted Answer

The macro 'get_failed_users' is not defined in the same app context as the saved search.. Macros are resolved in the context of the app where the saved search is defined. If the macro 'get_failed_users' is not defined in the same app context as the 'Brute Force Detection' saved search, the subsearch will fail to resolve the macro and return no results, even though the macro works when run manually in a different app context. Splunk's macro resolution depends on the app context of the search, not the user's current app.

Answer

The subsearch is not part of the data model acceleration and is limited by the time range of the main search.

Answer

The subsearch uses a macro, and macros cannot be used in subsearches.

Answer

The macro definition has a typo in the search command.

SPLK-1002 Macros, Saved Searches and CIM Practice Question

Why each option matters

Option-by-option breakdown

Related to this question