Splunk Core Certified Power User — Question 142

Which of the following is correct syntax for using a macro called change_thing with two arguments in SPL?

Answer options

• A. 'change_thing("field1,field2")'
• B. 'change_thing(field1,field2)'
• C. 'change_thing'(field1,field2)
• D. change_thing(field1,field2)

Correct answer: B

Explanation

The correct syntax for calling a macro in SPL requires the macro name followed by the parameters enclosed in parentheses, without quotes around the entire call. Option B correctly represents this format. Options A and C incorrectly place quotes around the macro call, while option D does not have quotes, but still is not the proper format as per the question's requirement.