Splunk Exam SPLK-1002 Topic 4 Question 113 Discussion

Actual exam question for Splunk's SPLK-1002 exam

Question #: 113
Topic #: 4

[All SPLK-1002 Questions]

The macro weekly sales (2) contains the search string:

index=games | eval ProductSales = $Price$ * $AmountSold$

Which of the following will return results?

A'weekly sales (3)'

B'weekly_sales($3.995, $108)'

C'weekly_sales (3.99, 10)'

D'weekly sales (3.99, 10)'

Show Suggested Answer

Suggested Answer: C

To use a search macro in a search string, you need to place a back tick character (`) before and after the macro name1. You also need to use the same number of arguments as defined in the macro2. The macro weekly sales (2) has two arguments: Price and AmountSold. Therefore, you need to provide two values for these arguments when you call the macro.

The option A is incorrect because it uses parentheses instead of back ticks around the macro name. The option B is incorrect because it uses underscores instead of spaces in the macro name. The option D is incorrect because it uses spaces instead of commas to separate the argument values.

by Wendell at Jul 04, 2025, 11:43 AM

Limited Time Offer

25%

Off

Get Premium SPLK-1002 Questions as Interactive Web-Based Practice Test or PDF