SPLK-1001 Using Fields and Lookups — 10 Questions

Question 1

A security analyst is investigating a suspicious IP address. They want to find all events related to that IP. Which field should they use in a search?

Accepted Answer

source_ip. Source_ip. In Splunk, when investigating a suspicious IP address, the source_ip field identifies the origin of network traffic. By searching for source_ip=<suspicious IP>, you retrieve all events where that IP was the initiator of a connection, which is the most direct way to find events related to that IP in network logs.

Answer

dest_ip

Answer

host

Answer

user

Question 2

A search returns many events but the 'status' field is missing from some events. The admin wants to set a default value of 'unknown' when the field is absent. Which command should be used?

Accepted Answer

fillnull value=unknown status. The `fillnull` command explicitly sets a default value for specified fields when they are null or missing in search results. In this scenario, `fillnull value=unknown status` replaces all null or absent 'status' field values with 'unknown', ensuring consistency across events. This command is designed specifically for handling missing field values in Splunk, unlike `eval` or `default` which operate differently.

Answer

eval status=coalesce(status, "unknown")

Answer

default status=unknown

Answer

replace status with "unknown"

Question 3

A user wants to see only events where the 'action' field has a value of 'success'. Which search syntax should they use?

Accepted Answer

action=success. In Splunk's Search Processing Language (SPL), a field-value pair like `action=success` is the most direct and efficient way to filter events where the field 'action' has the value 'success'. This syntax leverages Splunk's index-time field extraction and inverted index lookup, making it faster than using the `where` or `search` commands for simple equality filters.

Answer

where action=success

Answer

lookup action=success

Answer

search action=success

Question 4

A lookup table contains employee names and IDs. An admin wants to add the employee name to events that contain an employee ID field called 'emp_id'. What is the correct lookup command syntax?

Accepted Answer

| lookup employee_lookup emp_id OUTPUTNEW employee_name. The `OUTPUTNEW` clause in a lookup command only adds fields from the lookup table that are not already present in the event, preventing overwriting of existing field values. In this scenario, the admin wants to add the employee name to events that already contain an `emp_id` field, so `OUTPUTNEW employee_name` ensures the name is appended without modifying any existing data.

Answer

| lookup employee_lookup employee_name FROM emp_id

Answer

| lookup employee_lookup emp_id OUTPUTNEW *

Answer

| lookup employee_lookup emp_id OUTPUT employee_name

Question 5

An admin notices that a lookup is not returning any results for some events even though matching keys exist. What is the most likely cause?

Accepted Answer

The lookup is case-sensitive and the key values have different cases. Lookups in Splunk are case-sensitive by default. If the lookup file contains key values in a different case (e.g., 'ABC') than the event field values (e.g., 'abc'), the lookup will not match, even though the underlying data is logically equivalent. This is a common cause of lookup failures when the data sources have inconsistent casing.

Answer

The lookup field name is different from the event field name

Answer

The lookup is defined with the wrong field order

Answer

The time range of the search is too narrow

Question 6

A Splunk admin wants to handle missing field values in a search. Which TWO SPL options can replace null values with a specified default? (Choose two.)

Accepted Answer

coalesce. Option A, coalesce, is correct because it takes multiple field arguments and returns the first non-null value, so specifying a literal default as the last argument (e.g., coalesce(field, "N/A")) replaces nulls with that default. Option D, fillnull, is correct because it is purpose-built to replace null values in one or more fields with a specified value, as in fillnull value="N/A" field. Option B, eval, is not a dedicated null-replacement command; while an eval expression like if(isnull(field), "N/A", field) can achieve a similar result, eval itself is a general evaluation command, not an SPL option designed to replace nulls. Option C, convert, is used to convert field values to numeric or other formats and does not substitute defaults for missing values. Option E, default, is not a valid SPL command or function for replacing null values.

Answer

eval

Answer

convert

Answer

default

Question 7

Refer to the exhibit. A user gets this error when running a search with a GeoIP lookup. What is the most likely cause?

Accepted Answer

The lookup file has not been uploaded to Splunk. The error message indicates that Splunk cannot find the lookup table referenced in the search. Option C is correct because the GeoIP lookup file must be uploaded to Splunk (as a CSV or KMZ file) and defined as a lookup table in the lookups.conf configuration before it can be used in a search. Without the file being present in the system, the lookup command fails with a 'lookup table not found' error.

Answer

The user does not have permission to use lookups

Answer

The lookup command syntax is incorrect

Answer

The field name in the lookup does not match the event field

Question 8

A company has a Splunk environment indexing firewall logs from multiple vendors. The security team wants to enrich events with a threat intelligence lookup that contains IP addresses and threat categories. The lookup file 'threat_intel.csv' has fields: ip, category, confidence. The admin runs the following search: index=firewall | lookup threat_intel.csv src_ip OUTPUT category confidence. However, the lookup returns no results, even though there are matching IPs. The admin verifies that the lookup file is uploaded and the field names are correct. What is the most likely cause? The admin suspects that the lookup is case-sensitive, but the IP addresses in the logs are lowercase and the lookup has uppercase. The admin also considers that the lookup might be configured with the wrong field order, or that the lookup command is missing the OUTPUTNEW option, or that the index name is wrong. Which course of action should the admin take first to resolve the issue?

Accepted Answer

Modify the lookup definition to set case_sensitive_match = false. The most likely cause is that the lookup is case-sensitive by default, and the IP addresses in the logs are lowercase while the lookup file contains uppercase IPs. Setting `case_sensitive_match = false` in the lookup definition forces Splunk to ignore case when matching, which resolves the issue without altering the data or command structure.

Answer

Swap the field order in the lookup command

Answer

Change OUTPUT to OUTPUTNEW to avoid overwriting fields

Answer

Change the index to default

Question 9

A Splunk admin is tasked with creating a dashboard that shows the top 10 error codes from application logs. The logs contain a field 'error_code' which is extracted automatically. The admin writes the search: index=app sourcetype=app_log | top limit=10 error_code. The dashboard shows the correct data, but the admin wants to add a drilldown that passes the selected error code to another search. The admin considers using the 'fields' command to keep only error_code, the 'table' command to display the data, the 'eval' command to create a new field, or the 'stats' command to count. Which change should the admin make to the search to enable the drilldown functionality?

Accepted Answer

Replace top with table error_code, count. The `table` command produces a tabular output that inherently supports drilldown in Splunk dashboards by preserving the raw event data and field values. When you use `table error_code, count`, the dashboard can pass the selected `error_code` value to another search via a token. The original `top` command aggregates data into a statistical summary that does not retain the raw event structure required for standard drilldown behavior.

Answer

Add a stats count by error_code

Answer

Replace top with fields to keep only error_code

Answer

Add an eval command to create a clickable link

Question 10

A security analyst runs a search for failed logins and wants to display the source IP address, username, and count of failures. However, the field 'src_ip' is not showing in the field picker. Which of the following is the most likely reason?

Accepted Answer

The field is not extracted by default from the data source.. In Splunk, fields like 'src_ip' are not automatically extracted from raw event data unless the data source has a predefined source type that includes field extraction rules (e.g., via a technology add-on or custom regex). If the field does not appear in the field picker, it typically means the search has not extracted it from the raw events, so the analyst must use commands like `rex` or `extract` to parse it.

Answer

The field has no values in the results.

Answer

The user does not have permission to view the field.

Answer

The field name contains a typo.