Exam SPLK-1002 Topic 4 Question 295 Discussion
Actual exam question for Splunk's SPLK-1002 exam
Question #: 295
Topic #: 4
Question #: 295
Topic #: 4
The macro weekly_sales (2) contains the search string:
index=games | eval ProductSales = $Price$ * $AmountSold$
Which of the following will return results?
index=games | eval ProductSales = $Price$ * $AmountSold$
Which of the following will return results?
Suggested Answer: C Vote an answer
To use a search macro in a search string, you need to place a back tick character (`) before and after the macro
name1. You also need to use the same number of arguments as defined in the macro2. The macro weekly sales
(2) has two arguments:PriceandAmountSold. Therefore, you need to provide two values for these arguments
when you call the macro.
The option A is incorrect because it uses parentheses instead of back ticks around the macro name. The option
B is incorrect because it uses underscores instead of spaces in the macro name. The option D is incorrect
because it uses spaces instead of commas to separate the argument values.
Reference:1Use search macros in searches - Splunk Documentation2Define search macros in Settings - Splunk
Documentation
name1. You also need to use the same number of arguments as defined in the macro2. The macro weekly sales
(2) has two arguments:PriceandAmountSold. Therefore, you need to provide two values for these arguments
when you call the macro.
The option A is incorrect because it uses parentheses instead of back ticks around the macro name. The option
B is incorrect because it uses underscores instead of spaces in the macro name. The option D is incorrect
because it uses spaces instead of commas to separate the argument values.
Reference:1Use search macros in searches - Splunk Documentation2Define search macros in Settings - Splunk
Documentation
by Sherry at Jun 24, 2026, 02:08 AM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).