SPLK-1004 Lookups And Alerts Practice Test 2 — 15 Questions

Question 1

You are creating a lookup definition that uses a KV Store collection. The lookup will be used in a search to enrich events with user details. You want to ensure that the lookup returns only the first matching entry when multiple entries match the lookup key. Which setting should you configure in the lookup definition?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set `max_matches = 1` in the lookup definition.. The `max_matches` setting in a lookup definition specifies the maximum number of matching rows to return for each input key. Setting it to 1 ensures that only the first match is used, which is useful when you want to avoid duplicate enrichment. This setting is available for both CSV and KV Store lookups and is configured in the lookup definition's advanced options.

Answer

Use the `OUTPUTNEW` command in the search to return only new fields.

Answer

Enable `case_sensitive_match = true` to force a single match.

Answer

Set `batch_index_query = true` to optimize the lookup for single matches.

Question 2

You are using the `lookup` command in a search to enrich events with data from a CSV lookup definition named `user_info`. After running the search, you notice that events with a `user` field containing uppercase letters (e.g., `JSMITH`) are not being enriched, while events with lowercase `user` values (e.g., `jsmith`) are enriched correctly. The lookup definition has `case_sensitive_match` set to its default value. What is the most likely cause of this behavior?

Accepted Answer

The `lookup` command is case-sensitive by default, so `JSMITH` does not match `jsmith` in the lookup table.. The default behavior of lookup definitions is to perform case-sensitive matching. When `case_sensitive_match` is true (the default), an uppercase value such as `JSMITH` will not match a lowercase entry like `jsmith`. To resolve this, you can either set `case_sensitive_match = false` in the lookup definition's advanced settings or use the `lookup` command with the `case_sensitive_match` argument set to false. This ensures that matches are made regardless of case.

Answer

The automatic lookup is not configured to run for events with uppercase `user` values because of a permissions issue.

Answer

The `lookup` command requires the lookup field to be in lowercase; you must convert the field using `lower()` before the lookup.

Answer

The lookup table file does not contain any entries with uppercase `user` values, so no match occurs.

Question 3

You are using the lookup command to enrich events with a CSV lookup that contains a field named priority. Your events already have a field named priority with different values. You want the lookup to add a new field called severity based on the lookup's priority, but you do not want to overwrite the existing priority field. Which syntax should you use?

Accepted Answer

| lookup priority_lookup src OUTPUT severity. To preserve the existing priority field and add a new severity field from the lookup, specify only severity in the OUTPUT clause. This adds the new field without touching priority. Using OUTPUT with priority would overwrite it, while OUTPUTNEW would skip priority but is less explicit. The most straightforward and predictable syntax is to output only the field you want to add.

Answer

| lookup priority_lookup src OUTPUTNEW priority, severity

Answer

| lookup priority_lookup src OUTPUTNEW severity

Answer

| lookup priority_lookup src OUTPUT priority, severity

Question 4

You need to create an alert that runs a search every hour and, when the results contain more than 100 events, sends an email to the security team and adds a note to a KV Store collection for further analysis. The alert should not trigger more than once per hour even if the condition remains true. Which alert configuration should you use?

Accepted Answer

Scheduled alert with cron schedule '0 * * * *', trigger condition 'number of results > 100', and actions: email and KV Store lookup output.. A scheduled alert with an hourly cron schedule runs once per hour, satisfying the frequency requirement. The trigger condition 'number of results > 100' ensures actions fire only when the threshold is exceeded. Configuring both email and KV Store lookup output actions in the same alert accomplishes both notification and data storage in a single run.

Answer

Scheduled alert with cron schedule '0 * * * *' and trigger condition 'number of results > 100', and set the alert to throttle for 60 minutes.

Answer

Real-time alert with trigger condition 'number of results > 100' and actions: email and KV Store lookup output.

Answer

Scheduled alert with cron schedule '0 * * * *' and trigger condition 'number of results > 100', but only the email action; then use a separate scheduled search to write to the KV Store.

Question 5

You are configuring a new alert in Splunk Enterprise. The alert must trigger an action that sends a formatted message to a third-party incident management system via a webhook. You need to define the alert action. Which two steps are required to set up this custom webhook alert action? (Choose two.)

Accepted Answer

Install and configure the alert action in the Splunk platform, then enable it for the alert.. To set up a custom webhook alert action, you must first develop the action using the Splunk SDK or REST API, which involves writing code to handle the webhook request. Then, you install and configure the app containing the action in Splunk, and enable it for the specific alert. These two steps are essential for creating and using a custom alert action.

Answer

Use the `sendalert` command in the search to invoke the webhook directly.

Answer

Create a scripted input to monitor for alert triggers and send the webhook.

Answer

Configure the alert to use the built-in "Webhook" alert action available in Splunk Enterprise.

Question 6

You are optimizing a search that uses a large CSV lookup. The lookup is applied to millions of events, and you need to improve performance. Which two actions can you take to reduce lookup overhead? (Choose two.)

Accepted Answer

Use the lookup command only after filtering the search results to a smaller set of events.. To reduce lookup overhead on large result sets, convert the CSV lookup to a KV Store lookup, which is indexed and faster for large datasets. Also, apply the lookup after filtering the search results to minimize the number of events that need enrichment. Both actions reduce the computational load and improve search performance.

Answer

Enable case-sensitive matching in the lookup definition to reduce the number of matches.

Answer

Use the lookup command with the local=true argument to force the lookup to run locally on the search head.

Answer

Limit the lookup to only the fields needed by using the fields argument in the lookup definition.

Question 7

You are designing a lookup strategy for a large environment with millions of events per day. You need to optimize lookup performance and reduce search time. Which two actions should you take? (Choose two.)

Accepted Answer

Ensure the lookup definition uses an indexed field for matching and avoid unnecessary fields in the lookup table.. Using KV Store lookups for frequently updated data provides indexed, fast access. Ensuring the lookup matches on an indexed field and contains only necessary fields reduces the data processed and speeds up lookups. Other options like wildcards or automatic lookups can add overhead, and limiting matches does not address the core performance of the lookup operation.

Answer

Enable the lookup definition's advanced option to limit the number of matches returned.

Answer

Use a wildcard in the lookup match field to broaden matches.

Answer

Define the lookup as automatic so it runs on every search without explicit lookup commands.

Question 8

You are using the `lookup` command in a search to enrich events with data from a CSV lookup. You want to replace the value of an existing field in your events with a value from the lookup, but only if the lookup returns a match. Which argument should you use in the `lookup` command?

Accepted Answer

REPLACE. The `lookup` command's `REPLACE` argument allows you to overwrite existing fields in your events with values from the lookup table. It only performs the replacement when a match is found. This is the correct way to conditionally replace field values. `OUTPUT` would always output the field, potentially overwriting with null if no match, and `OUTPUTNEW` would not overwrite existing fields.

Answer

APPEND

Answer

OUTPUTNEW

Answer

OUTPUT

Question 9

You are troubleshooting a scheduled alert that is not triggering. You have verified that the search returns results when run manually, the alert is enabled, and the schedule is correct. You also confirmed that the alert's permissions are set correctly. Which additional configuration should you check that could prevent the alert from triggering?

Accepted Answer

The alert's expiration time has passed, causing the alert to be automatically disabled.. Scheduled alerts can be configured with an expiration time. If that time has passed, the alert is automatically disabled, even if it appears enabled in the UI. This is a subtle configuration that can prevent triggering. Verifying the expiration setting is an important step when an alert fails to trigger despite other settings being correct.

Answer

The alert's cron schedule is set to run in a time zone that is different from the Splunk server's time zone, causing a mismatch.

Answer

The alert's time range is set to a relative time that does not include the current time.

Answer

The alert's trigger condition is set to "Number of Results" and the threshold is set higher than the actual number of results.

Question 10

You are creating a lookup definition that uses a KV Store collection. The lookup will be used in a search to enrich events with user details. You want to ensure that the lookup returns only the first matching entry when multiple entries match the lookup key. Which setting should you configure in the lookup definition?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set 'Case Sensitive' to false in the lookup definition's advanced options.. The lookup definition's 'Case Sensitive' setting controls whether the lookup engine compares values with exact case. Disabling it allows 'jsmith' to match 'JSMITH' from the CSV. This is the direct and correct configuration to achieve case-insensitive matching. Other options deal with match types, limits, or defaults, which do not address the case sensitivity requirement.

Answer

Set 'Default Match' to true in the lookup definition.

Answer

Set 'Match Type' to 'CIDR' in the lookup definition.

Answer

Set 'Max Matches' to 0 in the lookup definition.

Question 11

You have an automatic lookup that enriches events with user details from a CSV file. The lookup is configured to output a field called 'department'. However, you notice that some events already have a 'department' field with a value, and you want to preserve the original value. Which setting in the automatic lookup configuration should you use?

Accepted Answer

Set 'Override' to false in the automatic lookup definition.. In automatic lookups, the 'Override' setting dictates whether lookup results replace existing fields. Setting it to false prevents overwriting, so any pre-existing 'department' field remains unchanged. This is the correct way to preserve original values. Other settings like 'Max Matches' or 'Case Sensitive' do not control field overwriting and would not solve the problem.

Answer

Set 'Max Matches' to 1 in the automatic lookup definition.

Answer

Set 'OutputNew' to true in the automatic lookup definition.

Answer

Set 'Case Sensitive' to false in the automatic lookup definition.

Question 12

You have an alert that runs a scheduled search every hour. The search uses a lookup to filter events, but the lookup file is updated daily at 2 AM. You notice that the alert sometimes triggers with stale lookup data. Which configuration should you adjust to ensure the alert uses the most current lookup data?

Accepted Answer

Set the lookup definition's 'Cache' setting to false to prevent caching.. To ensure the alert uses the most current lookup data, disable caching by setting the 'Cache' setting to false in the lookup definition. This forces Splunk to read the lookup file from disk on each search, avoiding stale cached data. Other options either break the lookup or do not address caching.

Answer

Set the lookup definition's 'Max Matches' to 0 to force a refresh.

Answer

Enable the 'Refresh' option in the lookup definition to reload the file on each search.

Answer

Schedule the alert to run only after 2 AM to ensure the lookup file is updated.

Question 13

A threat intelligence team maintains a KV Store collection named `malware_hashes` containing a `hash` field. Analysts want to enrich events in a search by adding a `malware_family` field, but the input field in the events is named `file_hash` and must be matched against the `hash` field in the collection. The lookup definition `malware_lookup` already exists and points to this collection. Which search syntax correctly enriches the events?

Accepted Answer

| lookup malware_lookup hash AS file_hash OUTPUT malware_family. The lookup command's AS clause maps lookup table fields to event fields, with the lookup field on the left and the event field on the right. Because the KV Store collection stores `hash` while events carry `file_hash`, the mapping `hash AS file_hash` is required so the match succeeds. The OUTPUT clause then names `malware_family` as the field to add to each matching event.

Answer

| lookup malware_lookup file_hash OUTPUT hash malware_family

Answer

| lookup malware_lookup file_hash AS hash OUTPUT malware_family

Answer

| lookup malware_lookup hash OUTPUT file_hash malware_family

Question 14

A security team wants an alert that enriches blocked-connection events with a department name from a CSV lookup, but the lookup file is replaced nightly by an automated job. The lookup occasionally becomes unreadable mid-replacement, causing the alert to return no enriched results. Which approach most reliably keeps the alert working while the file is replaced?

Accepted Answer

Convert the CSV lookup to a KV Store lookup and use the `outputlookup` command to refresh the collection. Non-atomic file replacement is the root cause, so the fix must change how the data is stored and updated. KV Store collections are updated atomically via `outputlookup`, and searches query the collection rather than the file, so consumers never see an intermediate state. This removes the read failures without relying on timing or retries.

Answer

Move the CSV to a network share and increase the lookup's `max_matches` setting

Answer

Add the `lookup` command with the `local=true` argument to force local file caching

Answer

Schedule the alert to run only after the nightly job completes and add a retry on failure

Question 15

Which permission setting is required for other users to use a lookup table you have created?

Accepted Answer

App or Global. For other users to use a lookup table, its permissions must be set to App or Global. App-level permissions make the lookup available to all users of that app, while Global permissions make it available across all apps. These settings ensure the lookup is shared beyond the owner.

Answer

Owner-only

Answer

System-only

Answer

Private