Splunk Updated SPLK-1002 Exam Questions and Answers by wyatt

POST workflow actions allow parameters to contain both fixed values and values substituted from event fields.

Extract: “POST arguments can include static text, field value substitutions, or a combination of both.”

The searches A and C show a valid use of a macro. A macro is a reusable piece of SPL code that can be called by using single quotes (‘’). A macro can take arguments, which are passed inside parentheses after the macro name. For example, ‘makeMyField(oldField)’ calls a macro named makeMyField with an argument oldField. The searches B and D are not valid because they use double quotes (“”) instead of single quotes (‘’).