Exam SPLK-1002 topic 1 question 26 discussion

Actual exam question from Splunk's SPLK-1002

Question #: 26
Topic #: 1

Given the macro definition below, what should be entered into the Name and Arguments fields to correctly configure the macro?

A. The macro name is sessiontracker and the arguments are action, JESSIONID.
B. The macro name is sessiontracker(2) and the arguments are action, JESSIONID.
C. The macro name is sessiontracker and the arguments are $action$, $JESSIONID$.
D. The macro name is sessiontracker(2) and the Arguments are $action$, $JESSIONID$.

Show Suggested Answer

Suggested Answer: B 🗳️

by Lalithadevi at April 4, 2021, 5:19 p.m.

Comments

Submit Cancel

emlch

Highly Voted 10 months, 3 weeks ago

Selected Answer: B

B is the correct answer. If your macro have arguments you must specify them in parenthesis after the macro name (like <macroname>(<numberofarguments>)) When you specify the arguments you have to tell splunk what are the arguments name (without the $).

upvoted 6 times

...