SPLK-1002 Advanced Visualization and Lookups Practice Test 11 — 15 Questions

Question 1

A security analyst is using a lookup table to enrich IP addresses with threat intelligence. Which THREE statements about lookups are true?

Accepted Answer

Lookups can be used to add fields from an external source. Option A is correct because a lookup's core purpose is to enrich events by pulling in additional fields from an external source (CSV, KV store, or a lookup definition) and appending them to the search results. Option D is correct because automatic lookups are defined in props.conf, where you specify the lookup name, the input field(s), and the output field(s) so the enrichment happens at search time without an explicit lookup command. Option E is correct because lookups can be backed by CSV files (file-based lookups) or by KV store collections (KV store lookups), both of which are valid lookup types in Splunk. Option B is wrong because lookups also support CIDR and wildcard matching, not just exact match. Option C is wrong because lookup data does not need to be indexed; it is referenced at search time from a file or KV store collection.

Answer

Lookups can only be used with exact match

Answer

Lookups require the data to be indexed in Splunk

Question 2

A dashboard panel uses a timechart to show error counts over time. Users report that the time range picker does not affect the panel. What is the most likely cause?

Accepted Answer

The search uses a fixed earliest and latest time.. If a search explicitly specifies earliest and latest time modifiers (e.g., earliest=-24h latest=now), those hardcoded values override the dashboard time range picker. The panel will always show the fixed window regardless of what the user selects. Removing the inline time modifiers allows the time picker to control the search.

Answer

The dashboard is not shared.

Answer

The panel uses 'stats' instead of 'timechart'.

Answer

The index is not time-based.

Question 3

You are a Splunk power user at a manufacturing company. You have created a timechart that shows machine temperature readings over time. The data is indexed with timestamps every minute, but the timechart shows gaps where no data exists because some machines may not report at all times. You want to fill the gaps with 0 values to avoid misleading visualizations. The current search is: index=manufacturing sourcetype=temperature | timechart span=1h avg(temp) by machine. Which modification to the timechart command will fill the gaps with 0?

Accepted Answer

timechart span=1h usenull=t. Usenull=t fills null values with 0. Option A is incorrect because cont=t ensures continuous time buckets but does not fill nulls with 0. Option B is incorrect because limit=0 does not affect null filling. Option D is incorrect because usenull=f leaves gaps, and useother=f is irrelevant.

Answer

timechart span=1h cont=t

Answer

timechart span=1h limit=0

Answer

timechart span=1h usenull=f useother=f

Question 4

Which TWO of the following statements about lookup tables in Splunk are true?

Accepted Answer

KV Store lookups require defining a collection in collections.conf.. Option C is correct because KV Store lookups are backed by MongoDB collections that must be declared in collections.conf (with the stanza name matching the collection) before the lookup definition in transforms.conf can reference it. Option D is correct because CSV lookups read the file at search time, so replacing the CSV file (or uploading a new version via Settings > Lookups) takes effect immediately without restarting Splunk. Option A is wrong because lookups can overwrite existing field values when the lookup output field name matches an event field. Option B is wrong because external lookups can run scripts or binaries that return data from virtually any source, not just CSV. Option E is wrong because lookup files can live in any app's lookups directory (e.g., $SPLUNK_HOME/etc/apps/<app>/lookups/) as well as system/lookups.

Answer

Lookups can only add new fields to events; they cannot replace existing field values.

Answer

External lookups can only retrieve data from CSV files.

Answer

Lookup files can only be stored in $SPLUNK_HOME/etc/system/lookups/.

Question 5

A network operations team has a lookup file named device_owners.csv that maps device_id to owner_name, but the file is updated nightly by an automated script. The field device_id appears in their firewall logs as src_device. They need searches to automatically return owner_name for each event without using the lookup command in every search. Which configuration should they use?

Accepted Answer

Create an automatic lookup that maps src_device to device_id in device_owners.csv and outputs owner_name.. Automatic lookups are configured in Settings > Lookups > Automatic lookups and apply to all searches without requiring the lookup command. By matching the event field src_device to the CSV column device_id and outputting owner_name, the lookup enriches events at search time. This satisfies the need for automatic, nightly-updated enrichment without editing individual searches.

Answer

Define a field alias so that src_device is renamed to device_id, then use the lookup command in each search.

Answer

Use a calculated field that concatenates src_device with values from the CSV file.

Answer

Create a scheduled report that runs the lookup command and writes results to a summary index, then search the summary index.

Question 6

A security analyst needs to enrich firewall events with a lookup file that contains IP ranges (CIDR notation) mapped to network zones. The lookup definition must match an event's `src_ip` against the correct CIDR range. Which lookup configuration should the analyst use?

Accepted Answer

Create a CSV lookup definition and set the match type to CIDR(src_ip).. The CIDR match type is specifically designed to match IP addresses against CIDR ranges in a lookup table. This allows the analyst to enrich events with network zone information based on whether the source IP falls within a defined subnet. Other match types like EXACT or WILDCARD cannot interpret CIDR notation, and IPV4 is not a valid match type.

Answer

Create a CSV lookup definition and set the match type to WILDCARD(src_ip).

Answer

Create a CSV lookup definition and set the match type to EXACT.

Answer

Create a CSV lookup definition and set the match type to IPV4.

Question 7

A Power User is building a dashboard that uses a lookup to enrich event data with a `priority` field from `priority_map.csv`. The lookup definition is named `priority_lookup` and matches on the `severity` field. The dashboard's base search returns events with a `severity` field, but the `priority` field is not appearing in the results. The Power User confirms the CSV is correctly formatted and the lookup definition is configured. Which SPL command should be added to the search to include the `priority` field?

Accepted Answer

`| lookup priority_lookup severity`. The `lookup` command is the correct way to enrich events with fields from a lookup table. By specifying the lookup definition name and the match field, Splunk will add the corresponding fields from the CSV to each event where the match field values align. This is the standard method for lookup enrichment in dashboards and searches, ensuring the `priority` field appears alongside event data.

Answer

`| outputlookup priority_lookup`

Answer

`| inputlookup priority_lookup`

Answer

`| join severity [inputlookup priority_lookup]`

Question 8

A compliance team wants a dashboard that shows the number of events per hour for the last 24 hours, but they want the chart to display the data as a stacked column chart with a separate column for each sourcetype. Which Splunk visualization should they use?

Accepted Answer

Column chart with stacked mode. The column chart visualization supports a stacked mode, where each column represents a time interval and segments within the column represent different series (e.g., sourcetypes). By using a timechart or chart command with split by sourcetype, the data can be rendered as stacked columns, fulfilling the need to show hourly counts per sourcetype.

Answer

Single value visualization

Answer

Line chart

Answer

Pie chart

Question 9

A dashboard developer needs to add a lookup to a dashboard so that users can view the mapping between error codes and descriptions. The mapping is stored in a CSV file named error_codes.csv with columns code and description. Users should be able to see the full mapping in a table panel without having to run a search that references any index. Which search should be used in the panel?

Accepted Answer

| inputlookup error_codes.csv. The inputlookup command is designed to read a lookup file and return its rows as search results. Because the panel only needs to display the static mapping in error_codes.csv, using inputlookup without an index search is the correct and efficient approach. It avoids scanning event data and directly presents the lookup contents in the table panel.

Answer

| datamodel error_codes.csv

Answer

| lookup error_codes.csv code OUTPUT description

Answer

| from error_codes.csv

Question 10

A support team has a lookup definition named ticket_priority that maps priority_code to a friendly priority label. They want a search to display both the original priority_code and the new priority_label field, while leaving priority_code unchanged even if the lookup contains a column with the same name. Which lookup command syntax accomplishes this?

Accepted Answer

lookup ticket_priority priority_code OUTPUTNEW priority_label. OUTPUTNEW adds only lookup fields that are not already present in the event, so the friendly priority_label is appended while the existing priority_code remains exactly as it was. This satisfies the need to display both values without the lookup clobbering the original code. Plain OUTPUT or explicitly listing the key field would risk overwriting the original value.

Answer

lookup ticket_priority priority_code OUTPUT priority_label

Answer

lookup ticket_priority priority_code OUTPUTNEW priority_code, priority_label

Answer

lookup ticket_priority priority_code OUTPUT priority_code, priority_label

Question 11

A fraud analyst needs to enrich transaction events with a risk score stored in a CSV lookup file. The risk scores change daily and are updated by an external system. The analyst wants the lookup to automatically use the latest file content without manually editing the lookup definition each time. Which lookup definition type should be configured?

Accepted Answer

File-based lookup. A file-based lookup definition points to a CSV file on the search head. When the external system replaces that file, subsequent searches read the new content automatically. KV Store lookups require explicit writes, automatic lookups only control application timing, and inline lookups embed data in the search itself, so none of those provide the required automatic file-based refresh.

Answer

KV Store lookup

Answer

Automatic lookup

Answer

Inline lookup

Question 12

A dashboard developer wants to add a single value visualization that shows the total number of failed login attempts in the last 24 hours. The search returns a single number. Which dashboard panel type should they use?

Accepted Answer

Single Value. The Single Value visualization is specifically designed to display a single numeric result, making it the correct choice for showing the total number of failed login attempts. Other visualizations like Gauge, Table, or Pie Chart are not optimized for this purpose and would either require additional configuration or not present the data clearly.

Answer

Gauge

Answer

Pie Chart

Answer

Table

Question 13

A Splunk user wants to create a lookup that maps employee IDs to department names. The data is currently in a CSV file on their local machine. Which Splunk feature should they use to upload the file and make it available for lookups?

Accepted Answer

Settings > Lookups > Lookup table files. Lookup table files are managed under Settings > Lookups > Lookup table files. Uploading a CSV there creates a lookup table file that can be used in lookup definitions. This is the standard method to make a CSV available for lookups without indexing its contents as events.

Answer

Settings > Data inputs > Files & directories

Answer

Add Data > Upload

Answer

Settings > Fields > Calculated fields

Question 14

A security team wants a lookup that matches events to threat intel entries valid for a specific date range, so an IP flagged last quarter does not match today's events. The threat feed is a CSV with ip, threat_label, valid_from, and valid_to columns. Which lookup configuration approach supports this time-bounded matching?

Accepted Answer

Define the lookup with a time field and configure a temporal match using valid_from and valid_to.. Temporal matching is a lookup definition feature that uses a designated event time field together with the lookup's begin and end timestamp columns. Configuring the definition this way makes Splunk include only rows whose validity range covers the event time, so expired threat intel is excluded. Match-field or output-field changes alone cannot enforce that window.

Answer

Use inputlookup to load the CSV and then append threat_label with appendcols.

Answer

Add valid_from and valid_to to the OUTPUT list of the lookup command.

Answer

Define the lookup with ip as the match field and set the definition type to automatic.

Question 15

A Splunk user wants to display the results of a search as a single value visualization that shows the total count of events from the last 24 hours. Which of the following should be used?

Accepted Answer

Use the `stats count` command and select the Single Value visualization.. To display a single value such as a total count, the search should return exactly one row and one column. The `stats count` command does this by aggregating all events into a single count. Other commands like timechart, top, or table return multiple rows or columns, which are not compatible with the Single Value visualization without additional transformation.

Answer

Use the `top` command and select the Single Value visualization.

Answer

Use the `timechart count` command and select the Single Value visualization.

Answer

Use the `table` command and select the Single Value visualization.