Create and Use a Basic Macro SPLK-1002 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A Splunk admin created a macro in the `search` app with permissions set to 'Global'. A user in the `main` app reports that the macro is not visible in the search bar's macro suggestions. The admin confirms the macro exists and is enabled. What is the most likely cause?

   • AThe macro was defined with an eval-based definition.
   • BThe user's role does not have permission to read macros from the `search` app.
   • CThe user is not typing the backtick character.
   • DThe macro name is too long to be suggested.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A macro named `errors_by_source` is defined as `index=main sourcetype=error | stats count by source`. A user runs the search `` `errors_by_source` | top source ``. What is the result?

   • AAll error events, because the `top` command is ignored.
   • BThe top sources by count from the macro's stats output.
   • CAn error because a macro cannot contain a pipe.
   • DThe top sources from the raw events, ignoring the stats.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A Splunk admin created a macro in the `search` app. A user in the same environment is working in the `main` app and cannot use the macro. What is the most likely reason?

   • AThe macro was defined with a relative timestamp that is now invalid.
   • BThe macro is scoped to the `search` app and is not available in other apps by default.
   • CThe user does not have permission to run searches in the `main` app.
   • DThe macro name contains a reserved keyword.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What does it mean for a macro to have 'global' scope?

   • AIt is automatically shared with all users without any permission checks
   • BIt is available only to users with the admin role
   • CIt is available only in the app where it was created
   • DIt is available in all apps for users who have permission to use it
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A macro named `search_by_user` is defined as `index=main user=$user$`. A user invokes it with `` `search_by_user(user=alice)` ``. What is the resulting search?

   • AAn error because the argument syntax is incorrect.
   • B`index=main user=$user$`
   • C`index=main user=alice`
   • D`index=main user=user=alice`
   Reveal Solution Discussion Select an answer first