Macros, Saved Searches and CIM practice questions

| stats count(src_ip) as unique_ips

Why wrong: `count` counts all events, not unique IPs.

| stats distinct_count(src_ip) as unique_ips

Why wrong: `distinct_count` is not a valid Splunk function.

| stats unique(src_ip) as unique_ips

Why wrong: `unique` is not a stats function.

Convert the saved search to a scheduled report.

Why wrong: Scheduling does not improve query performance.

Replace the join with a subsearch.

Why wrong: Subsearches can be slower than joins.

Use the `fields` command to remove unnecessary fields before the join.

Why wrong: Removing fields may not resolve the join overhead.

The host field is case-sensitive.

Why wrong: Case sensitivity is not the issue.

The host field is not indexed.

Why wrong: The host field is typically indexed.

The macro is evaluated before the rest of the search.

Why wrong: Evaluation order is not the cause.

Defining user roles and permissions for data access.

Why wrong: CIM does not manage roles.

Managing license usage across indexers.

Why wrong: CIM does not handle licensing.

Creating new indexes for faster search performance.

Why wrong: CIM does not create indexes.

Save the search without scheduling it to avoid resource usage.

Why wrong: Scheduling is optional but best practice includes scheduling if needed.

Avoid specifying a time range to use the default.

Why wrong: Always specify a time range for consistency.

$macro_name(arg1, arg2)$

Why wrong: Dollar signs are used for token substitution, not macro calls.

macro_name:arg1, arg2

Why wrong: Colon is not used for macro arguments.

| macro_name(arg1, arg2)

Why wrong: Macros are not called with a pipe.

The user who owns the saved search does not have permissions to run it at that time.

Why wrong: Permissions do not cause job expiration.

The indexer has reached its license quota and stops processing.

Why wrong: License quota does not cause job expiration.

The search is consuming too much disk space.

Why wrong: Disk space issues cause different errors.

Enable 'Digest mode' with a time window of 5 minutes.

Why wrong: Digest mode sends a single alert with all results, but doesn't throttle per IP.

Configure the search to use a 'Real-time' window of 5 minutes and set 'Alert on' to 'Result count'.

Why wrong: Real-time window is not appropriate for a scheduled search, and doesn't provide throttling.

Set the 'Alert condition' to 'Number of results > 100' and use a rolling time window of 5 minutes.

Why wrong: This only defines the trigger condition, not suppression.

`eval username=extract("User: (?<username>\S+)")`

Why wrong: eval cannot use extract with regex; rex is needed.

`rex field=_raw "User: (?<username>\S+)" | eval username=$result$`

Why wrong: $result$ is not a valid macro token for this purpose.

`username = rex field=_raw "User: (?<username>\S+)"`

Why wrong: In a macro definition, you cannot assign to a variable outside of eval.

Use the 'calculatedfields' field in props.conf: `CALCULATED_action = if(action=="accept","allowed",if(action=="deny","blocked","dropped"))`

Why wrong: Calculated fields can create new fields but are not the standard way to map to CIM fields.

Create a custom data model that includes the field 'action' with the vendor values.

Why wrong: Creating a custom data model is not required; CIM fields can be mapped via aliases.

Add a tag 'action=accept' to events with action=accept, and similarly for deny and drop.

Why wrong: Tags are not used to map field values; they are used for event categorization.

Set the search to 'Run on a timer' and increase the schedule interval to 20 minutes.

Why wrong: Increasing interval may cause data loss and does not guarantee no overlap if execution time varies.

Enable the 'Schedule Priority' setting to 'Higher' and set 'Schedule Window' to 0.

Why wrong: Schedule Priority does not prevent overlap; Schedule Window just delays start.

Reduce the search time window to 5 minutes to decrease execution time.

Why wrong: This could miss data and still may not solve the overlap if execution time remains high.

Add a macro definition to props.conf under a [source] stanza.

Why wrong: Macros are not defined in props.conf.

Use the CLI command `splunk add macro` with the macro definition.

Why wrong: There is no CLI command to add macros.

Edit the macros.conf file in the app's default directory.

Why wrong: The default directory is not for local configurations; local directory is used.

Application State

Why wrong: There is no Application State data model in CIM.

Change Analysis

Why wrong: Change Analysis is part of ITSI, not CIM.

`stats avg($field$) | eval avg_response=$result$`

Why wrong: $result$ is not valid in macro definition.

"stats avg($field$) as avg_response"

Why wrong: Macro definitions must be enclosed in backticks, not double quotes.

`stats avg($field$) as avg_$field$`

Why wrong: $field$ is not valid; should be $field$ but the macro definition should have the argument name without $.

The macro definition uses positional arguments but the call uses named arguments.

Why wrong: The macro definition already defines named args (args=...) so named arguments are expected.

The macro call is missing a closing parenthesis.

Why wrong: The call has proper parentheses; the error occurs at end of command.

The macro call uses named arguments instead of positional arguments.

Why wrong: Named arguments are valid for macros; this is not the cause.

`index=windows_security sourcetype=WinEventLog:Security EventCode=4625 | stats count by src_ip | where count > 10`

Why wrong: This uses raw field names, not CIM fields; it may not work with CIM apps.

`| from datamodel:Authentication.Failed_Authentication | where EventCode=4625 | stats count by src_ip | where count > 10`

Why wrong: Wrong field 'src_ip' not in CIM; should use 'Authentication.src'.

`index=windows_security EventCode=4625 | transaction src_ip maxspan=10m | where eventcount > 10`

Why wrong: Transaction may not scale and is not CIM compliant.

Change the scheduled time to 1:00 AM to avoid other concurrent heavy searches.

Why wrong: May help but does not address the dispatch time limit directly.

Increase the 'dispatch.earliest_time' and 'dispatch.latest_time' settings for the saved search to allow a longer execution window.

Why wrong: Those settings control the time range of data searched, not the execution time limit.

Reduce the search time range from 'last 24 hours' to 'last 1 hour' to speed up the query.

Why wrong: Changes the data scope; results may not be as intended.

It improves search performance by pre-aggregating data.

Why wrong: CIM does not pre-aggregate data; it only provides a common schema. Performance improvements are not a direct benefit.

It provides built-in security monitoring use cases.

Why wrong: CIM is a data model, not a security solution; it does not include built-in use cases.

It eliminates the need for custom field extractions.

Why wrong: CIM defines common field names but does not eliminate the need for custom field extractions; extractions are still required to populate those fields.

The saved search permissions are set to 'Private', so the macro does not apply.

Why wrong: Permissions affect who can see the search, not macro expansion; macros are resolved at search time regardless of permissions.

The macro should be invoked with a pipe, like `| time_filter` instead of backticks.

Why wrong: The backtick syntax is correct for macro invocation; a pipe would treat it as a search command, which is not the intended use.

The macro is disabled; the admin needs to enable it in the macros list.

Why wrong: If the macro were disabled, it would not expand at all; the search would likely fail or show no results, not wrong time range.