SPLK-1002 Macros, Saved Searches and CIM Practice Question
Which TWO of the following are valid ways to reference a macro in a search?
⚠ Common exam trap
Many candidates confuse the backtick macro syntax with the dollar-sign token syntax used in dashboards or the pipe command syntax, leading them to select invalid options like A or E.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
`macro_name(arg1, arg2)`
In Splunk, a macro is invoked using backticks with parentheses around its arguments, as in `macro_name(arg1, arg2)`. This syntax tells the search processor to expand the macro definition with the provided arguments before executing the search.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
$macro_name(arg1, arg2)$
Why it's wrong here
Dollar signs are used for token substitution, not macro calls.
- ✗
macro_name:arg1, arg2
Why it's wrong here
Colon is not used for macro arguments.
- ✓
`macro_name(arg1, arg2)`
Why this is correct
Backticks with parentheses and comma-separated arguments.
- ✓
`macro_name arg1 arg2`
Why this is correct
Backticks with space-separated arguments (if defined that way).
- ✗
| macro_name(arg1, arg2)
Why it's wrong here
Macros are not called with a pipe.
Go deeper
Related to this question
About these practice questions
One of 475 original SPLK-1002 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.