Describe Macros SPLK-1002 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A Splunk admin is troubleshooting a macro that is not working as expected. The macro is defined as `my_macro(field)` and expands to `eval new_field=$field$ | table new_field`. When the admin invokes the macro as `my_macro(_raw)`, the search fails. What is the most likely cause?

   • AThe macro requires the argument to be enclosed in quotes.
   • BThe macro argument `_raw` is being interpreted as a literal string, not as a field reference.
   • CThe macro is not available in the current app context.
   • DThe macro is not valid because it uses `eval` and `table` in the same definition.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Where in Splunk Web do you go to create a new macro?

   • ASettings > Knowledge > Macros
   • BSettings > Data Inputs > Macros
   • CSettings > Advanced Search > Search Macros
   • DSearch app > Macros tab
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   When creating a macro in Splunk Web, which of the following is a required field?

   • APermissions
   • BValidation string
   • CDestination app
   • DMacro name
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A Splunk admin wants to create a macro that will be used by several teams. The macro should be available to all users and should be validated before it is used. What is the correct sequence of steps to create this macro in Splunk Web?

   • ANavigate to Settings > Search > Macros, click New, enter the name and definition, and save.
   • BNavigate to Settings > Advanced Search > Search Macros, click New, enter the name and definition, validate the syntax, and save.
   • CNavigate to Settings > Data Inputs > Macros, click New, enter the name and definition, and save without validation.
   • DNavigate to Settings > Knowledge > Macros, click New, enter the name and definition, and save.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following best describes how a macro benefits a Splunk user?

   • AIt reduces the amount of SPL you need to write by reusing common search patterns.
   • BIt allows sharing of dashboards and reports with other users.
   • CIt automatically optimizes search performance by pre-computing results.
   • DIt enforces data access restrictions based on user roles.
   Reveal Solution Discussion Select an answer first