You defined a lookup that is not working. You verified the CSV exists and the app permissions are correct. What search-time troubleshooting step should you perform?
An analyst built a calculated field in Settings > Fields > Calculated Fields with the expression 'upper(src_ip)' and named it 'src_ip_upper'. After saving, searches for 'src_ip_upper=10.0.0.1' return no results, although 'src_ip=10.0.0.1' returns many events. What is the most likely cause?
A Splunk administrator is configuring an automatic lookup on the 'authentication' sourcetype to enrich events with user department information from a CSV lookup named 'user_departments.csv'. The lookup definition is named 'user_dept_lookup'. The administrator wants the department field to be added to events as 'user_department'. Which stanza should be added to props.conf to achieve this?
A security analyst needs every raw event containing an RFC 1918 source address in the `src_ip` field to also be searchable by the friendly name `internal_ip`, but the raw event text must remain unchanged on disk and in the UI. Which props.conf configuration accomplishes this for the `firewall` sourcetype?
A Splunk power user is designing a search that uses a calculated field to normalize HTTP status codes. The calculated field 'status_category' is defined as 'case(status >= 200 AND status < 300, "Success", status >= 300 AND status < 400, "Redirect", status >= 400 AND status < 500, "Client Error", status >= 500, "Server Error", true(), "Unknown")'. After running the search, the user finds that 'status_category' is null for some events even though the 'status' field is present and numeric. What is the most likely explanation for the null values?
A power user needs to create a field alias so that searches using 'clientip' automatically match the existing extracted field 'src'. The user has permission to edit knowledge objects but wants the alias to apply to all sourcetypes in the current app. Where should this alias be configured?
A Splunk administrator is configuring field aliases and calculated fields for a set of sourcetypes. Which of the following statements are true regarding the order of evaluation and behavior of these search-time field operations? (Choose two.)
An analyst runs `index=web | eval status_class=case(code>=500,"server_error", code>=400,"client_error", code>=300,"redirect", true(),"success")`. Events with a null `code` field are returned with `status_class=success`. The analyst wants null `code` values to produce `unknown` instead. Which modification achieves this?
A security analyst wants to create a calculated field named `response_time` that subtracts the value of the `start_time` field from the `end_time` field, but only when both fields are present and numeric. The analyst needs to ensure the calculated field is available to all users in the `security` app and does not impact performance for searches that don't use it. Which of the following is the correct approach?
An administrator maintains a lookup table `user_map.csv` that is updated nightly by an external script. The lookup definition currently uses `case_sensitive_match = false` and the search `| lookup user_map userid AS user OUTPUT department` returns stale departments for some users. Which setting should be examined first to ensure the lookup reflects the most current file contents without restarting Splunk?
A power user is troubleshooting a dashboard panel that uses a lookup to enrich events with a 'region' field. The lookup file is updated daily, but the panel sometimes shows stale region values even after the file is replaced. The panel search references the lookup with the lookup command. Which action best ensures the panel always uses the latest lookup file content without restarting Splunk?
A Splunk power user is creating calculated fields for a dashboard that monitors web server performance. The user wants to extract the response time from a field named `duration_ms` (which is in milliseconds) and display it in seconds as `duration_sec`. The user also wants to create a field `status_category` that categorizes HTTP status codes into 'success' (2xx), 'redirect' (3xx), 'client_error' (4xx), and 'server_error' (5xx). Which TWO of the following calculated field definitions are correct and will achieve these goals? (Choose two.)
A knowledge manager is defining a regex-based field extraction in props.conf for a custom sourcetype. Which TWO statements about search-time field extraction precedence and behavior are accurate? (Choose two.)
A Splunk power user needs to create a field alias so that searches using `clientip` automatically match the existing extracted field `src_ip`. The user wants this alias to apply only to events from the `access_combined` sourcetype. Which of the following is the correct configuration to achieve this?
A Splunk power user is creating calculated fields in `props.conf` to normalize data from multiple sourcetypes. The user wants to ensure that the calculated fields are evaluated correctly and efficiently. Which two of the following statements are true regarding calculated fields? (Choose two.)
A Splunk power user wants to rename the extracted field `src_ip` to `client_ip` at search time without modifying the original data or creating a new field. Which of the following should the user do?
You have a field 'status' that contains numerical codes. You want to create a field 'status_desc' that maps these codes to human-readable text. What is the recommended tool?
You are configuring a field lookup that needs to execute automatically for every search on a specific sourcetype. Where is the most appropriate place to configure this?
You have a calculated field that performs a complex regex extraction and math calculation. When a user searches, the calculation is not appearing. What is the most likely cause?
You need to create a persistent field mapping that allows users to search for 'user_id' instead of 'uid' without modifying the underlying raw data. Which feature should you use?
A security team wants every event tagged with the sourcetype 'cisco:asa' to also carry the tag 'firewall' so analysts can search 'tag=firewall' without typing the sourcetype. A power user opens Settings > Tags and sees no existing tags for that sourcetype. What is the most efficient way to apply the tag to ALL current and future cisco:asa events?
A Splunk administrator wants to create a calculated field that combines the values of two existing extracted fields, 'src_ip' and 'dest_ip', into a new field named 'conversation' with a hyphen separating them. The administrator needs this field to be available in searches immediately without editing any configuration files on the indexers. Where should the administrator define this calculated field?
A Splunk power user is troubleshooting a search that uses a calculated field named 'response_time' defined as 'duration_ms / 1000'. The field 'duration_ms' is extracted from raw events, but the calculated field returns null values for some events. Upon investigation, the user finds that 'duration_ms' is sometimes missing or contains non-numeric characters. Which of the following is the most likely reason for the null values in 'response_time'?
A security analyst needs a calculated field named `risk_score` that evaluates to the numeric value 10 for every event in the `firewall` sourcetype, regardless of whether any other fields are present. The analyst has created the field in Settings > Fields > Calculated Fields, set the App context to `search`, and set the eval expression to `10`. However, searches in the `main` index for `sourcetype=firewall` do not display the `risk_score` field. Which of the following is the most likely cause?
A Splunk user wants to create a calculated field that extracts the domain from an email address field named 'email'. The user writes the following eval expression: 'mvindex(split(email, "@"), 1)'. After saving the calculated field, the user notices that the new field 'domain' is not appearing in the Fields sidebar for some events. What is the most likely cause?
A Splunk administrator wants to rename the extracted field `src_ip` to `client_ip` at search time without modifying the original data or creating a new field. The administrator also wants the original field name `src_ip` to remain available in searches. Which of the following should the administrator configure?
A knowledge manager needs an ad-hoc calculated field named `resp_seconds` available only within a single dashboard panel that computes `round(duration_ms/1000, 2)` from an existing numeric field. The value must not persist to the knowledge object store and must not appear in other searches. Which approach should be used?
A Splunk power user is configuring a calculated field that uses the eval function 'coalesce' to handle null values. The user wants to ensure the calculated field is evaluated correctly. Which TWO of the following statements about calculated fields in props.conf are true? (Choose two.)
A security team wants every event that contains the string 'Failed password' to be automatically tagged as 'brute_force' so that analysts can later run a simple tag-based search without typing the full string each time. The tag should appear on matching events as soon as the search runs, with no index-time processing. Which of the following is the correct way to implement this?
An administrator is configuring a calculated field in props.conf to derive a new field from two extracted fields. The stanza is applied to a sourcetype, but users report the calculated field does not appear in search results. The extracted fields are present and correct. Which of the following is the most likely cause?
A Splunk administrator is configuring a field extraction for a custom sourcetype. The raw event data contains a field named `user` that sometimes includes a domain prefix (e.g., `DOMAIN\username`). The administrator wants to create a new field `username` that contains only the username portion, stripping the domain prefix if present. The extraction should work at search time and be available for all users. Which of the following is the most efficient and correct method?
A knowledge manager is reviewing how calculated fields and field aliases interact within a search. Which TWO of the following statements are accurate? (Choose two.)
A team is standardizing a lookup file `product_catalog.csv` that maps `product_id` to `product_name`, `category`, and `list_price`. They want searches to automatically enrich events that contain a matching `product_id`. Which two configurations accomplish this automatic enrichment? (Choose two.)
A power user wants to add a calculated field named `response_time` to all events of the `web` sourcetype. The value should be the difference between two existing numeric fields, `end_time` and `start_time`, and must be available in every future search without retyping the eval command. Where should this be configured?
A junior analyst needs to search for events where a field named 'status_code' equals 404, but the field is only present under the name 'http_status' in the indexed data. The analyst wants to use 'status_code' in searches without changing the data or the extraction. Which of the following should be configured?
A power user has a lookup definition named `asset_lookup` that maps `host` to `owner` and `location`. In a search they run `| lookup asset_lookup host OUTPUT owner` and notice that the `location` field is absent from the results even though the CSV contains it. What is the reason?
A Splunk administrator defines a calculated field in props.conf with EVAL-total_bytes that sums two extracted fields, bytes_in and bytes_out. After saving, searches on the sourcetype still do not show total_bytes, although bytes_in and bytes_out appear correctly. The administrator confirms the stanza name matches the sourcetype exactly. Which of the following is the most likely explanation?
An engineer defines a calculated field in Settings > Fields with the expression `eval total_bytes = upload_bytes + download_bytes` scoped to sourcetype `netflow`. Searches confirm the field appears. Later, a new field named `total_bytes` is extracted from the raw event by a search-time extraction. What is the resulting behavior for the calculated field?
A Splunk user wants to create a field alias so that the field `src_ip` can also be referred to as `client_ip` in searches. The user has added the following to `props.conf` in the `search` app: `FIELDALIAS-client_ip = src_ip AS client_ip`. After restarting Splunk, the user searches for `client_ip=192.168.1.1` but gets no results, even though `src_ip=192.168.1.1` returns events. What is the most likely reason for this?
A power user configures an automatic lookup that enriches events with a `priority` field from a CSV, and also defines a calculated field `severity = priority * 10` via EVAL in props.conf. After deploying, `severity` is always null. What is the cause?
A Splunk administrator is troubleshooting a calculated field that is not appearing in search results. The calculated field is defined in `props.conf` as `EVAL-total = price * quantity`. The administrator confirms that the `price` and `quantity` fields are present in the events and that the `props.conf` file is correctly placed in the app's `local` directory. However, when searching for `total`, no results are returned. Which of the following is the most likely cause?
A Splunk power user is building a dashboard that must display the total revenue per product category. The raw events contain a field named `price` (numeric) and a field named `quantity` (numeric). The user wants to create a calculated field named `revenue` that multiplies these two fields, and ensure it is available for all future searches without modifying the raw data. Which of the following is the correct method to achieve this?