SPLK-1002 Advanced Visualization and Lookups Practice Test 6 — 15 Questions

Question 1

The security operations center (SOC) team at a medium-sized enterprise uses Splunk to investigate potential threats. They maintain a CSV lookup file named 'threat_intel.csv' that contains a list of known malicious IP addresses along with a threat score. The lookup is configured in transforms.conf as:

[threat_intel]
filename = threat_intel.csv
match_type = WILDCARD(ip)

They frequently run the following search to enrich firewall events with threat scores:

index=firewall sourcetype=firewall_logs | lookup threat_intel src_ip OUTPUT threat_score | where threat_score > 5

Recently, analysts noticed that some IP addresses known to be present in the lookup file are not being matched in search results. They have verified that the lookup file is correctly formatted and contains those IPs, and the transforms.conf has not been altered. They also confirmed that the events contain the field src_ip with the correct IP addresses. Which of the following is the most likely cause of the missing matches?

Accepted Answer

The IP addresses in the lookup file are stored in a different case (e.g., uppercase) than in the events (lowercase).. The most likely cause is that the IP addresses in the lookup file and the events have different cases (e.g., uppercase vs. lowercase). Splunk lookups are case-sensitive by default unless the match_type is set to ignore case. Since the match_type is WILDCARD (which is still case-sensitive), case differences will prevent matching. Option A is correct.

Answer

The search is limited to a time range that excludes events with those IP addresses.

Answer

The lookup file contains duplicate entries for some IPs, causing conflicts.

Answer

The lookup command requires the input_fields parameter to specify which field to use for matching.

Question 2

A large e-commerce company uses Splunk to monitor transactions. They have a CSV lookup file named 'customer_lookup.csv' containing 5 million rows of customer data (customer_id, name, address, tier). The lookup is used in a search that runs every hour to generate a report of sales by customer tier:

index=transactions sourcetype=transaction_logs | lookup customer_lookup customer_id OUTPUT name, address, tier | timechart count by tier

The search often times out or takes too long to complete, impacting operational dashboards. The team is considering optimization strategies. The lookup file is updated daily and stored in a custom app directory. The Splunk environment is distributed with a single search head and multiple indexers. Which of the following recommendations would most effectively improve the search performance?

Accepted Answer

Convert the CSV lookup to a KV Store lookup by defining a collection and populating it from the CSV.. The most effective optimization is to convert the CSV lookup to a KV Store lookup (Option B). KV Store lookups are designed for high-performance key-value operations and scale better than CSV lookups for millions of rows, significantly reducing search time. Option A (subsearch) would actually degrade performance. Option C (partial=true) only affects timechart display, not lookup speed. Option D (removing output fields) improves only slightly and may lose useful data.

Answer

Use a subsearch to first find matching customer IDs and then join with the lookup.

Answer

Use the `timechart` command with `partial=true` to allow the search to return intermediate results.

Answer

Remove the OUTPUT fields name and address from the lookup, keeping only the tier field.

Question 3

A Splunk administrator is creating a dashboard to visualize real-time network traffic data. The dashboard must include a lookup to enrich source IPs with location data. The lookup file contains 500,000 entries and is updated hourly. Which TWO optimization techniques should the administrator apply to ensure dashboard performance?

Accepted Answer

Use a KV store lookup instead of a CSV lookup.. KV Store lookups are optimized for large, frequently updated datasets (like 500,000 entries updated hourly) by storing data in-memory and supporting indexed lookups, which significantly reduces search-time overhead compared to CSV lookups that require file parsing and scanning. This makes KV Store ideal for real-time dashboards where low latency is critical.

Answer

Use the append command instead of lookup to add fields.

Answer

Set the lookup to batch_index_query=true in transforms.conf.

Answer

Use a subsearch to filter the lookup file before joining.

Question 4

Refer to the exhibit. The lookup 'lookup_user_info' is used in a search: `| lookup lookup_user_info user_id OUTPUT department`. Users report that many events show 'UNKNOWN' as department even though the user_id exists in the CSV. What is the most likely cause?

Accepted Answer

The field name in the CSV header is 'User_ID' (capital U), while the event field is 'user_id' (lowercase). Splunk field matching is case-sensitive.. Splunk lookups are case-sensitive when matching field values. The exhibit shows the CSV header uses 'User_ID' (capital U), while the search references 'user_id' (lowercase). Since the lookup field name in the definition must exactly match the event field name, the mismatch causes the lookup to fail, returning 'UNKNOWN' for all events even when the user_id exists in the CSV.

Answer

The lookup file is not distributed to all indexers.

Answer

The match_type is not specified, defaulting to EXACT, but the CSV contains case variations.

Answer

The max_matches should be set to 0.

Answer

The lookup definition is missing the default_match setting, which should be set to 'no_match'.

Question 5

A company's security team uses Splunk to monitor firewall logs. They have a lookup file named 'threat_intel.csv' containing 10,000 IP addresses classified by threat level. The lookup is used in a dashboard that shows the number of blocked connections from high-threat IPs over the past 24 hours. Recently, the dashboard has become slow, taking over 30 seconds to load. The lookup file is updated every 15 minutes via a script that replaces the entire file. The search currently uses: `index=firewall | lookup threat_intel.csv src_ip OUTPUT threat_level | where threat_level="high" | stats count`. Which of the following is the MOST efficient way to improve dashboard performance?

Accepted Answer

Convert the lookup to a KV store collection with an index on src_ip.. Converting the lookup to a KV Store collection with an index on `src_ip` allows Splunk to perform efficient key-value lookups without loading the entire 10,000-row CSV into memory on every search. The KV Store uses an indexed data structure, which dramatically reduces lookup time compared to a file-based lookup that must be fully scanned each time, especially when the file is replaced every 15 minutes and the search runs over a 24-hour window.

Answer

Restrict the search to a smaller time range, such as the last hour.

Answer

Use the lookup with local=t to force it to run on the search head only.

Answer

Increase the lookup cache size in limits.conf.

Question 6

A Splunk Power User maintains a CSV lookup file `product_codes.csv` that maps `product_id` to `product_name`. The file is updated nightly. Users report that new product IDs added to the CSV are not being matched in searches until the search head is restarted. The lookup definition currently has no advanced settings configured. Which action should the Power User take to ensure new entries are recognized without a restart?

Accepted Answer

Set the lookup definition's 'Cache' setting to false.. The lookup definition's cache setting controls whether Splunk caches the lookup file contents in memory. When caching is enabled (default), changes to the CSV are not reflected until the cache is refreshed, often requiring a restart. Disabling the cache forces a fresh read for each search, ensuring new product IDs are matched immediately. This is the appropriate fix for frequently updated lookup files.

Answer

Add a scheduled search that runs `inputlookup product_codes.csv | outputlookup product_codes.csv` every night.

Answer

Enable the 'Advanced' setting and set 'Max Match' to 0.

Answer

Configure the lookup definition to use 'Lookup File Monitoring' and set a refresh interval.

Question 7

A Splunk administrator is designing a lookup that maps internal subnets to business units. The lookup table contains a single column named subnet with values such as 10.10.0.0/16 and 192.168.5.0/24. Events contain a src_ip field. The administrator wants the lookup to match an event when src_ip falls within any listed subnet, and also wants the lookup to return a default value of Unassigned when no subnet matches. Which two actions are required to meet these goals? (Choose two.)

Accepted Answer

Set the lookup definition's advanced option to default to Unassigned when no match is found.. CIDR matching must be enabled on the lookup definition so that src_ip can match entries like 10.10.0.0/16. Separately, the lookup definition must be configured with a default value so that non-matching events receive the Unassigned business unit instead of a null field. Together these settings deliver both the subnet-based matching and the fallback value the administrator needs.

Answer

Add a calculated field in props.conf that extracts the subnet from src_ip before the lookup runs.

Answer

Create the lookup definition as a KV Store collection and enable accelerated lookups.

Answer

Use the inputlookup command with append=t to merge the subnet list into the event stream.

Question 8

A security analyst needs to add a static field named `threat_level` with the value `high` to all events from a specific index. The field must be available in every search without being defined in each search. What should the analyst do?

Accepted Answer

Create a calculated field in props.conf using the EVAL-threat_level directive.. Calculated fields defined in props.conf via EVAL-<fieldname> are evaluated at search time and automatically added to events matching the stanza. This makes the static field available in every search without modifying the original data or requiring per-search commands. The other methods either require explicit invocation, only affect display, or create separate summary data, failing to meet the requirement.

Answer

Define a lookup definition that maps a dummy key to the value `high` and invoke it with the lookup command in each search.

Answer

Add the field to the default fields list in the Splunk Web settings under Fields.

Answer

Use a scheduled search that runs every minute to append the field to all events using the collect command.

Question 9

A security team has a lookup file `user_roles.csv` with fields `user` and `role`. They want to create a search that returns all users from the lookup file who have the role 'admin' and also includes a count of how many times each admin user appears in the `authentication` index over the last 24 hours, even if the count is zero. Which search should they use?

Accepted Answer

| inputlookup user_roles.csv WHERE role="admin" | join type=left user [ search index=authentication earliest=-24h | stats count by user ] | fillnull value=0 count. To include all admin users from the lookup file regardless of whether they have authentication events, the search must start with the lookup file and then left-join the authentication counts. The left join retains all rows from the lookup, and fillnull replaces missing counts with zero. This ensures that every admin user appears with their count, even if zero.

Answer

| inputlookup user_roles.csv | where role="admin" | lookup authentication user OUTPUT count | fillnull value=0 count

Answer

Answer

Question 10

A security analyst needs to create a lookup that returns a severity level based on a combination of two fields: src_ip and dest_port. The lookup file ports.csv has columns src_ip, dest_port, and severity. Which lookup configuration correctly matches events using both fields?

Accepted Answer

Define a lookup with lookup key src_ip and dest_port, leaving match_type as the default (exact).. A lookup can use multiple fields as lookup keys. When match_type is exact (the default), Splunk requires all specified event fields to match the corresponding lookup columns. Defining lookup keys src_ip and dest_port ensures that severity is returned only when both fields match a row in ports.csv, providing accurate multi-field enrichment.

Answer

Create two separate lookups, one for src_ip and one for dest_port, and use the lookup command twice.

Answer

Define a lookup with lookup key src_ip and dest_port, and set match_type to CIDR(src_ip).

Answer

Define a lookup with lookup key src_ip only and set match_type to CIDR(src_ip), then use where severity>0.

Question 11

A security operations center uses Splunk to monitor firewall traffic. The team has a lookup file `threat_intel.csv` containing a field `ip_address` and a field `threat_level`. They want to enrich firewall events with the `threat_level` from the lookup, but only if the event's `src_ip` matches an entry in the lookup. Events that do not match should still appear in the results with a `threat_level` of "unknown". Which SPL command should they use?

Accepted Answer

lookup threat_intel ip_address AS src_ip OUTPUT threat_level | fillnull value=unknown threat_level. The requirement is to enrich events with a lookup field and provide a default value for unmatched events. The `lookup` command adds the field when a match is found, but leaves it null otherwise. The `fillnull` command then replaces null values with a specified string. Combining these two commands achieves the desired outcome. The other options either do not provide a default value or use a less standard approach.

Answer

lookup threat_intel ip_address AS src_ip OUTPUT threat_level | eval threat_level=coalesce(threat_level, "unknown")

Answer

lookup threat_intel ip_address AS src_ip OUTPUTNEW threat_level

Answer

lookup threat_intel ip_address AS src_ip OUTPUT threat_level

Question 12

A fraud analyst maintains a CSV lookup named account_owners.csv that maps account_id to a human owner. The file is edited weekly by a different team. The analyst wants every search that uses the lookup to automatically pick up the newest file contents without editing the search or the lookup definition each week. Which lookup definition setting must be configured so the lookup refreshes from the file on each use?

Accepted Answer

Leave the lookup definition's default refresh behavior, since file-based lookups are always re-read at search time.. Because a file-based lookup definition is resolved from the CSV at search time, replacing the file is sufficient for later searches to see the new account owners. No refresh parameter, scheduled rewrite, or storage migration is required. The analyst only needs the existing lookup definition to keep pointing at the file path the team updates each week.

Answer

Create the lookup definition with the collection type instead of file so entries are indexed.

Answer

Schedule a saved search that runs inputlookup and outputlookup to rewrite the lookup file hourly.

Answer

Set the lookup definition's case_sensitive_match argument to true.

Question 13

A Splunk administrator needs to create a lookup that enriches events with user details from an external REST API. The API returns JSON and requires an API key for authentication. The lookup must be usable in searches like `| lookup user_details user_id` and should cache results to reduce API calls. Which lookup type should be used?

Accepted Answer

External lookup using a custom Python script that queries the API.. An external lookup is designed to call an external script during search time, making it ideal for integrating with REST APIs. The script can handle authentication and JSON parsing, and Splunk's lookup definition supports caching via TTL and max_matches, reducing API calls. Other lookup types either require static data or additional scheduling, failing to meet the real-time enrichment requirement.

Answer

KV Store lookup with a scheduled search to populate the collection.

Answer

Automatic lookup using a CSV file that is updated by a modular input.

Answer

CSV lookup with a scheduled script to fetch data from the API.

Question 14

A security team uses a lookup definition named threat_intel that maps the event field src_ip to a lookup field ip and returns a threat_category field. The lookup file is updated every hour by a script that overwrites the CSV. Analysts report that searches using the lookup sometimes return stale threat categories for up to an hour after the file is updated. What should be done to ensure the lookup always uses the most current file contents?

Accepted Answer

Verify that the lookup definition is not configured to use a cached copy and ensure the search head is reading the CSV from the correct path.. Lookup definitions can use a cache to improve performance, which may cause searches to use an older version of the CSV. Disabling the cache or ensuring the lookup is not configured to use a cached copy allows each search to read the current file. Verifying the file path also ensures the script is updating the file that Splunk actually reads, which resolves the staleness.

Answer

Change the lookup definition to use a KV Store collection and configure the script to update the collection instead of the CSV.

Answer

Enable lookup acceleration on the threat_intel definition and set a refresh interval of one hour.

Answer

Add the lookup command with the local=true argument to force reading the CSV from the local search head instead of the indexers.

Question 15

A compliance team needs to create a lookup that automatically updates from a CSV file hosted on a shared drive. The CSV file is updated daily by an external system. The lookup must be available for searches and scheduled reports without manual intervention. Which two configurations are required to achieve this? (Choose two.)

Accepted Answer

Ensure the CSV file is placed in the `$SPLUNK_HOME/etc/apps/<app_name>/lookups` directory or a custom path defined in the lookup definition.. To have a lookup that automatically updates from a CSV file, you need to define it as a file-based lookup in `transforms.conf` and ensure the CSV file is in a location Splunk can read, such as the app's `lookups` directory. Splunk reads the file at search time, so external updates are picked up automatically. No scheduled searches or KV Store configurations are needed.

Answer

Create a lookup definition that uses a scheduled search to periodically import the CSV data into a KV Store collection.

Answer

Use the `outputlookup` command to write the updated data back to the CSV file after each search.

Answer

Configure a scheduled search that runs the `inputlookup` command to refresh the lookup.