nerdexam
Splunk

SPLK-1002 · Question #129

In which Settings section are macros defined?

The correct answer is C. Advanced Search. In Splunk, search macros are created and managed under Settings > Advanced Search.

Creating and Using Macros

Question

In which Settings section are macros defined?

Options

  • AFields
  • BTokens
  • CAdvanced Search
  • DSearches, Reports, Alerts

How the community answered

(36 responses)
  • A
    3% (1)
  • B
    6% (2)
  • C
    92% (33)

Why each option

In Splunk, search macros are created and managed under Settings > Advanced Search.

AFields

The Fields section under Settings manages field extractions, calculated fields, and field aliases - not macros.

BTokens

Tokens are a dashboard panel concept used for dynamic inputs and drilldowns; there is no standalone Tokens section under Settings for macro management.

CAdvanced SearchCorrect

Splunk stores search macros under Settings > Advanced Search > Search Macros. This section allows users to define reusable search strings with optional arguments that are referenced in searches using backtick syntax, enabling consistent reuse of complex search logic.

DSearches, Reports, Alerts

Searches, Reports, and Alerts is where saved searches and alert configurations are managed, not where search macros are defined.

Concept tested: Splunk search macro definition location in Settings

Source: https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Definesearchmacros

Topics

#macros#Splunk settings#search macros#Splunk UI

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice