Question bank
Splunk Core Certified Power User
46 Splunk Core Certified Power User questions with the correct answer and a written explanation, organised across 10 exam domains.
- 46 questions
- 10 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
CIM Normalization
5 questions in this domain
- Question 1Single Choice
During a Splunk search, which special symbol should be placed around a macro name to invoke it correctly?
- ABacktick (`)Correct answer
- BParentheses ( )
- CDollar sign ($)
- DAsterisk (*)
Why this is the answer
A macro is invoked by surrounding its name with backticks, such as `my_macro`; using the name alone causes syntax errors.
- Question 2Multiple Select
Which of the following mistakes can cause a macro call to fail when used in a Splunk search?
- AUsing backticks around the macro name
- BForgetting the backticks around the macro nameCorrect answer
- CPlacing the argument outside the backticksCorrect answer
- DCalling the macro with arguments without parenthesesCorrect answer
Why this is the answer
Common traps include missing backticks, placing arguments outside the backticks, and omitting parentheses when arguments are used.
- Question 3Interactive
Review the SPL shown in the code block. Which statement about the macro invocation is correct?
- AIt calls the macro named my_macro with the argument error_codeCorrect answer
- BIt calls a macro named error_code with the argument my_macro
- CIt is invalid because the macro name and argument are reversed
- DIt creates a field called my_macro with the value error_code
Why this is the answer
The backticks surround the macro name with a parenthesized argument, so `my_macro(error_code)` invokes my_macro and passes error_code.
- Question 4Single Choice
Which configuration file is typically used to store Splunk macro definitions at the system, app, or user level?
- Amacros.confCorrect answer
- Bcommands.conf
- Csavedsearches.conf
- Dprops.conf
Why this is the answer
Macros are stored in configuration files, typically macros.conf, and can be defined at system, app, or user level.
- Question 5Multiple Select
Which of the following statements accurately describe valid reasons for creating and using a macro in Splunk?
- ATo centralize a complex series of eval statements or OR conditionsCorrect answer
- BTo update a single definition and affect all searches, dashboards, and alerts that use itCorrect answer
- CTo accept runtime arguments and make searches more flexibleCorrect answer
- DTo store raw event data for later searching
Why this is the answer
Macros simplify frequently used SPL, improve maintenance efficiency, and support parameterized searches; they do not store raw data.
Correlation (stats vs transaction)
7 questions in this domain
- Question 6Single Choice
In Splunk SPL, what symbol must surround a macro name when you invoke it?
- ABackticks (`)Correct answer
- BParentheses ()
- CDollar signs ($)
- DSingle quotes
Why this is the answer
Macro invocation requires backticks around the macro name, for example `my_macro`. Without backticks, Splunk treats the name as a field or command.
- Question 7Multiple Select
Which statements about Splunk macro arguments are true?
- AArguments are defined with placeholders such as $arg1$.Correct answer
- BValues are passed in parentheses inside the backticks, for example `my_macro(value)`.Correct answer
- CThe argument value passed in a search must include the placeholder name, such as `my_macro($arg1$)`.
- DArguments must be surrounded by double quotes to be recognized.
Why this is the answer
In macro definitions, arguments use $name$ placeholders. At invocation, only values are passed inside backticks with parentheses; the placeholder name is not supplied.
- Question 8Interactive
Review the SPL in the code block. What is wrong with the macro invocation shown?
- AThe argument must be placed inside the backticks and parentheses, like `my_macro(error_code)`.Correct answer
- BThe macro name should be in double quotes instead of backticks.
- CThe argument should be enclosed in square brackets.
- DThe search is correct; no change is needed.
Why this is the answer
Arguments must be inside the backticks with parentheses, such as `my_macro(error_code)`. Placing the argument outside the backticks is a common macro mistake.
- Question 9Single Choice
What syntax is used to define a placeholder for an argument inside a Splunk macro definition?
- A$arg1$Correct answer
- B`arg1`
- C(arg1)
- D%arg1%
Why this is the answer
Macro arguments use dollar-sign placeholders such as $arg1$. During invocation, Splunk replaces the placeholder with the supplied value.
- Question 10Multiple Select
Which statements about Splunk macro scope are correct?
- AMacros defined at the system level are available across all apps.Correct answer
- BMacros defined in a specific app are primarily available within that app.Correct answer
- CA macro with Private permissions is visible to all users who can search.
- DWhen a global macro and an app macro have the same name, the global macro always takes precedence.
Why this is the answer
System-level macros are global, app-level macros are sandboxed, private macros are not shared, and namespace collisions usually resolve in favor of the more local definition.
- Question 11Interactive
In the search shown in the code block, how should the expression wrapped in backticks be interpreted?
- AA macro invocationCorrect answer
- BA field name
- CA search command
- DA time range alias
Why this is the answer
The backticks identify the element as a macro call. A macro expands to a string of SPL before the final query is parsed and executed.
- Question 12Single Choice
When can a macro defined in one specific app be used in a different app?
- AOnly if it is explicitly shared globally or defined at the system level.Correct answer
- BIt is never available in another app.
- CIt is automatically available after a restart.
- DIt is available only when using the eval command.
Why this is the answer
App-level macros are local by default. To be used across apps, they must be shared globally or moved to a system-level definition.
Data Models
5 questions in this domain
- Question 13Single Choice
Which symbol must surround a macro name to invoke it in a Splunk search?
- AAn asterisk (*)
- BA backtick (`)Correct answer
- CA dollar sign ($)
- DA pair of parentheses ()
Why this is the answer
Macros are invoked with backticks around the macro name. Using the name alone causes Splunk to interpret it as a field or command, leading to syntax errors.
- Question 14Multiple Select
Which two statements correctly describe arguments in Splunk macros?
- AValues passed in parentheses must match the order of placeholders in the definition.Correct answer
- BThe argument value must be the same as the placeholder name used in the definition.
- CMacros do not validate argument data types before execution.Correct answer
- DArguments remain visible to outer search components after the macro runs.
Why this is the answer
Macro argument order must correspond to the placeholders, and macros have no built-in data type validation. The placeholder name does not need to be used in the call, and arguments are localized to the macro.
- Question 15Interactive
Based on the provided SPL snippet, what does the expression inside the backticks represent?
- AThe name of a field being extracted
- BAn argument passed to the macro my_macroCorrect answer
- CA second macro called before my_macro
- DA subsearch that returns events
Why this is the answer
The backtick syntax invokes my_macro and passes error_code as the argument value. It is not a field, second macro, or subsearch.
- Question 16Single Choice
In which location are Splunk macro definitions typically stored?
- Atransforms.conf
- Bmacros.confCorrect answer
- Cprops.conf
- Dindexes.conf
Why this is the answer
Macros are stored in configuration files, typically macros.conf, and can be defined at system, app, or user level.
- Question 17Multiple Select
Which three scopes can be used when defining a macro?
- AAppCorrect answer
- BUserCorrect answer
- CSystemCorrect answer
- DDashboard
Why this is the answer
Macros can be defined at the system, app, or user level. Dashboard is not a macro definition scope.
Field Aliases & Calculated Fields
4 questions in this domain
- Question 18Single Choice
What symbol must surround a macro name when invoking it in a Splunk search?
- ABacktickCorrect answer
- BParenthesis
- CDollar sign
- DAngle bracket
Why this is the answer
The playbook states that macro invocation requires the backtick symbol surrounding the macro name, such as `my_macro`.
- Question 19Multiple Select
Which two statements about macro scope are true?
- ASystem-level macros are available across all apps.Correct answer
- BA macro defined in a local app is automatically available in all other apps.
- CA macro with Private permissions is not visible to other users.Correct answer
- DApp-level macros are always visible to all users in every app context.
Why this is the answer
System-level macros are global, while app-level macros remain local unless shared. A macro with Private permissions is hidden from other users.
- Question 20Interactive
In the macro definition shown in the code block, what is the purpose of the value enclosed in dollar signs?
- AIt is a placeholder that receives the argument passed during macro invocation.Correct answer
- BIt is a literal string that appears in every search result.
- CIt is a field alias assigned by Splunk at search time.
- DIt is a comment ignored by the search engine.
Why this is the answer
The placeholder uses dollar signs and a name to inject the passed argument into the macro's definition at search time.
- Question 21Single Choice
What happens if you reference a macro name without backticks in a search?
- ASplunk treats it as a field name or a command and may raise a syntax error.Correct answer
- BSplunk automatically expands it into the macro definition.
- CSplunk ignores the text and continues the search.
- DSplunk converts it into a subsearch.
Why this is the answer
The playbook warns that forgetting backticks causes Splunk to interpret the macro name as a field or a command, leading to syntax errors.
Field Extractions
4 questions in this domain
- Question 22Single Choice
Which symbol must surround a macro name when a user invokes a macro in a Splunk search?
- ABackticks (`)Correct answer
- BParentheses ( )
- CDollar signs ($)
- DSquare brackets [ ]
Why this is the answer
Macros are invoked by surrounding the macro name with backticks, for example `my_macro`. Without backticks, Splunk treats the name as a field or command.
- Question 23Multiple Select
Which of the following statements about arguments in Splunk macros are true? Select all that apply.
- APlaceholders are written like $arg1$Correct answer
- BArguments are substituted literally before parsingCorrect answer
- CMacros validate integer and string types
- DThe placeholder name must be used as the value
Why this is the answer
Macro placeholders use dollar signs and names, and arguments are substituted literally. Macros do not validate data types, and calls pass values rather than placeholder names.
- Question 24Interactive
Given the macro definition in the code block, which invocation correctly passes the value 500 to the macro?
- A`my_macro(500)`Correct answer
- Bmy_macro(500)
- C`my_macro` (500)
- D500(`my_macro`)
Why this is the answer
A macro with arguments is invoked by placing the macro name and its parenthesized arguments inside the backticks, like `my_macro(500)`. The value 500 is substituted for the $status_code$ placeholder.
- Question 25Single Choice
In a Splunk environment, where are macro definitions typically stored within the configuration system files?
- Amacros.confCorrect answer
- Bprops.conf
- Ctransforms.conf
- Dinputs.conf
Why this is the answer
Macros are defined in macros.conf, at system, app, or user level. Other configuration files serve different purposes.
Filtering & Formatting (eval, where, fillnull)
4 questions in this domain
- Question 26Single Choice
Which symbol must surround a macro name when it is invoked in a Splunk search?
- ABackticks (`)Correct answer
- BParentheses ()
- CDollar signs ($)
- DSquare brackets []
Why this is the answer
Macros are invoked by surrounding the macro name with backtick symbols, such as `my_macro`.
- Question 27Multiple Select
Which statements about macro arguments are true? Select all that apply.
- AArguments are passed inside backticks, for example `macro(value)`.Correct answer
- BPlaceholder names must be included when calling the macro.
- CArguments are local to the macro's execution scope.Correct answer
- DMacros validate argument data types.
Why this is the answer
Arguments are passed in parentheses inside the backticks, are substituted into the macro, and are local to the macro. Placeholder names are not passed, and macros do not validate data types.
- Question 28Interactive
Review the SPL in the code block. What is returned when this macro call is processed?
- AA string of SPL based on the macro definitionCorrect answer
- BA set of events matching ERROR
- CA syntax error because macros are not allowed after a pipe
- DA field named ERROR
Why this is the answer
A macro returns a string of SPL that is substituted into the search before execution; it does not directly return events or field values.
- Question 29Single Choice
In which configuration file are Splunk macros typically stored?
- Amacros.confCorrect answer
- Bprops.conf
- Ctransforms.conf
- Dsavedsearches.conf
Why this is the answer
Splunk macro definitions are stored in macros.conf at system, app, or user level.
Macros
5 questions in this domain
- Question 30Single Choice
Which symbol is required when invoking a macro in a Splunk search?
- ABacktickCorrect answer
- BParenthesis
- CDollar sign
- DPipe
Why this is the answer
Macros are invoked by surrounding the macro name with backtick characters, distinguishing them from fields or commands.
- Question 31Multiple Select
Which statements correctly describe Splunk macros?
- AMacros return a string of SPL inserted into the search.Correct answer
- BA macro called by name alone without symbols executes normally.
- CArgument placeholders are replaced with literal text before parsing.Correct answer
- DMacros return a filtered result set before the main query.
Why this is the answer
Macros produce a SPL string and placeholders undergo literal substitution before parsing, not run-time filtering.
- Question 32Interactive
In the code block, a macro is invoked with an argument. Where is the argument placed?
- AInside parentheses immediately after the macro nameCorrect answer
- BInside dollar signs around the macro name
- COutside backticks, before the macro
- DAfter the pipe command
Why this is the answer
Valid macro calls place arguments inside parentheses, and the entire expression is wrapped in backticks.
- Question 33Single Choice
Where are Splunk macro definitions typically stored?
- Amacros.confCorrect answer
- Bprops.conf
- Ctransforms.conf
- Dcommands.conf
Why this is the answer
Macro definitions are stored in macros.conf, and scope can be system, app, or user level.
- Question 34Multiple Select
Which of the following are common mistakes when using Splunk macros?
- ACalling a macro without surrounding its name with backticksCorrect answer
- BPlacing the argument outside the backticksCorrect answer
- CUsing dollar signs to define placeholders
- DStoring macro definitions in macros.conf
Why this is the answer
Forgetting backticks and placing arguments outside backticks are documented traps that lead to syntax errors.
Tags & Event Types
4 questions in this domain
- Question 35Single Choice
What symbol is required in SPL to invoke a macro?
- ABackticks (` `)Correct answer
- BParentheses ()
- CDollar signs ($)
- DSquare brackets []
Why this is the answer
In SPL, macros are invoked with backticks around the macro name. Omitting them makes Splunk interpret the name as something other than a macro.
- Question 36Multiple Select
Which two statements correctly describe macro invocation in Splunk SPL?
- AThe macro name must be surrounded by backticks.Correct answer
- BArguments must be placed inside the backticks with the macro name.Correct answer
- CArguments are placed outside the closing backtick.
- DA macro can be invoked by simply typing its name.
Why this is the answer
Macro invocation requires backticks, and argument values must be inserted inside those backticks, as in `macro(value)`. Placing arguments outside or omitting backticks causes incorrect parsing.
- Question 37Interactive
Review the SPL statement shown in the code block. What will Splunk do when this statement is used in a search?
- AIt invokes the macro and passes 'error_code' as an argument.Correct answer
- BIt treats the macro name as a field and searches for 'error_code'.
- CIt returns a syntax error because arguments require square brackets.
- DIt invokes the macro without passing any argument.
Why this is the answer
The code block shows a macro invocation with an argument inside the backticks. Splunk substitutes the argument value into the macro before parsing the final search.
- Question 38Single Choice
Where are macro definitions typically stored in Splunk?
- Amacros.confCorrect answer
- Bprops.conf
- Ctransforms.conf
- Dindexes.conf
Why this is the answer
Macros are defined in macros.conf. The file can exist at system, app, or user scope, affecting visibility and permissions.
Visualizations (chart, timechart)
3 questions in this domain
- Question 39Single Choice
What is the correct way to invoke a macro called my_macro in a Splunk search?
- A`my_macro`Correct answer
- Bmy_macro
- C$my_macro$$
- D[my_macro]
Why this is the answer
Macros are invoked with backticks around the macro name. Without backticks, Splunk interprets the text as a field or command, causing errors.
- Question 40Multiple Select
Which statements accurately describe macro scope and accessibility in Splunk? Select all that apply.
- AApp-level macros are mainly available within that app.Correct answer
- BSystem-level macros are available across all apps.Correct answer
- CPrivate macros are visible to all users.
- DA local app macro works in other apps by default.
Why this is the answer
App-level macros are sandboxed to their app, while system-level macros are global. Private permissions restrict visibility, and local macros are not shared to other apps automatically.
- Question 41Interactive
Examine the macro invocation in the code block. What happens to error_code when the search executes?
- AIt is substituted into the macro's argument placeholder.Correct answer
- BIt is treated as a literal field name.
- CIt is ignored because macros accept no arguments.
- DIt must match the placeholder name in the definition.
Why this is the answer
Arguments passed inside parentheses are substituted literally into the macro's placeholder. The value does not need to match the placeholder name, and macros without arguments would not accept it.
Workflow Actions
5 questions in this domain
- Question 42Single Choice
Which symbol must surround a macro name when invoking it in a search?
- ABacktick (`)Correct answer
- BParentheses ( )
- CDollar signs ($)
- DSquare brackets ([ ])
Why this is the answer
Macros must be invoked with backticks around the macro name. Without backticks, Splunk treats the text as a command or field name.
- Question 43Multiple Select
Which statements accurately describe macros according to the documentation?
- AMacros return a string of SPLCorrect answer
- BMacros are invoked with backticksCorrect answer
- CMacros validate argument data types
- DMacros can store repeated OR conditionsCorrect answer
Why this is the answer
Macros return SPL text, are invoked with backticks, and can hold complex repeated logic. They do not validate argument data types.
- Question 44Interactive
Review the macro invocation in the code block. What issue is present?
- AThe argument is outside the backticksCorrect answer
- BThe argument is inside the parentheses
- CBackticks are missing
- DThe invocation is valid
Why this is the answer
The argument appears after the backticks. It must be inside the backticks and parentheses, like `my_macro(error_code)`.
- Question 45Single Choice
What is the main maintenance benefit of using macros for repeated SPL logic?
- AOne definition updates all referencesCorrect answer
- BSearch results are permanently cached
- CIndex size is reduced automatically
- DRole permissions are ignored
Why this is the answer
Updating the macro definition immediately reflects the change across every search, dashboard, and alert that references it.
- Question 46Multiple Select
Which common traps are described in the documentation?
- AForgetting the backticksCorrect answer
- BConfusing macros with subsearchesCorrect answer
- CPlacing arguments outside the backticksCorrect answer
- DUsing parentheses to pass arguments
Why this is the answer
Common traps include omitting backticks, confusing macros with subsearches, and putting arguments outside the backticks. Parentheses are required.
Frequently asked questions
Everything about the Splunk Core Certified Power User question bank and how to use it.