Add and Use Arguments with a Macro SPLK-1002 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A Splunk admin has a macro `search_user(user)` defined as `sourcetype=access user=$user$`. A user invokes the macro as `search_user(user=alice smith)`. The search fails. What is the most likely cause?

   • AThe value contains a space, which breaks the argument parsing.
   • BThe macro definition uses `$user$` but the invocation uses `user` without dollar signs.
   • CThe macro requires the `user` argument to be numeric.
   • DThe macro name is case-sensitive and the user typed it incorrectly.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   When passing a value that contains a space to a macro argument, how should you handle it?

   • AEscape each space with a backslash, e.g., `my_macro(value\ with\ spaces)`
   • BUse single quotes, e.g., `my_macro('value with spaces')`
   • CReplace spaces with underscores
   • DEnclose the value in double quotes, e.g., `my_macro("value with spaces")`
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   How do you pass a value to a macro argument when invoking the macro in a search?

   • ABy using an equals sign, e.g., `my_macro=value`
   • BBy appending the value in parentheses after the macro name, e.g., `my_macro(value)`
   • CBy using a colon after the macro name, e.g., `my_macro: value`
   • DBy placing the value in square brackets, e.g., `my_macro[value]`
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Given a macro named `filter_by_status` defined with arguments `field` and `status`, which invocation correctly passes the value `error` for the `status` argument?

   • A`filter_by_status(field, error)`
   • B`filter_by_status(error)`
   • C`filter_by_status(status=error)`
   • D`filter_by_status(error, field)`
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is a valid troubleshooting step when a macro returns an error about invalid arguments?

   • ADelete the macro and recreate it
   • BChange the macro name
   • CCheck the macro definition to ensure the argument names match the placeholders
   • DRestart Splunk
   Reveal Solution Discussion Select an answer first