Macros, Saved Searches and CIM →mediumMultiple ChoiceObjective-mapped

SPLK-1002 Macros, Saved Searches and CIM Practice Question

Exhibit

Refer to the exhibit.

Macro definition:
```
define my_summary($index, $time_range) [search index=$index$ earliest=$time_range$ latest=now | stats count by sourcetype | rename count as total]
```

The macro is called as:
```
| `my_summary(main, -1h)`
```

The admin calls the macro as shown. What will be the expanded search string?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

search index=main earliest=-1h latest=now | stats count by sourcetype | rename count as total

Macro arguments are substituted: $index$ becomes 'main', $time_range$ becomes '-1h'. The brackets define the search inside. Option B incorrectly concatenates. Option C uses single quotes. Option D swaps order.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
search index=main earliest=-1h latest=now | stats count by sourcetype | rename count as total
Why this is correct
Correct substitution: $index$ -> main, $time_range$ -> -1h.
✗
search index='main' earliest='-1h' latest=now | stats count by sourcetype | rename count as total
Why it's wrong here
Quotes are not added by macro expansion; they are passed literally if included in argument.
✗
search index=-1h earliest=main latest=now | stats count by sourcetype | rename count as total
Why it's wrong here
Order of arguments is reversed; first argument maps to $index$.
✗
search index=main|earliest=-1h latest=now | stats count by sourcetype | rename count as total
Why it's wrong here
Incorrect spacing; macro expands with spaces around arguments.

Go deeper

SPLK-1002 Macros, Saved Searches and CIM Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question