SPLK-1001 Using Fields and Lookups — 30 Questions

Question 1

A lookup table contains employee names and IDs. An admin wants to add the employee name to events that contain an employee ID field called 'emp_id'. What is the correct lookup command syntax?

Accepted Answer

| lookup employee_lookup emp_id OUTPUTNEW employee_name. The `OUTPUTNEW` clause in a lookup command only adds fields from the lookup table that are not already present in the event, preventing overwriting of existing field values. In this scenario, the admin wants to add the employee name to events that already contain an `emp_id` field, so `OUTPUTNEW employee_name` ensures the name is appended without modifying any existing data.

Answer

| lookup employee_lookup employee_name FROM emp_id

Answer

| lookup employee_lookup emp_id OUTPUTNEW *

Answer

| lookup employee_lookup emp_id OUTPUT employee_name

Question 2

An analyst runs a search and needs to view only events where the 'status' field has a value of 'failed'. Which command should be used?

Accepted Answer

where status = "failed". The `where` command in Splunk allows you to filter events based on a field value using a comparison expression. In this case, `where status = "failed"` evaluates each event and retains only those where the `status` field exactly matches the string "failed". This is the appropriate command when you need to filter results after the initial search has already been run, or when you need to use comparison operators that are not available in the `search` command.

Answer

table status

Answer

search status=failed

Answer

eval status = "failed"

Question 3

A user runs a search for errors but notices that the `source` field is not appearing in the selected fields list. What is the most likely reason?

Accepted Answer

The field `source` is a default field and is always present.. Although the user reports that the `source` field is not appearing in the selected fields list, the `source` field is indeed a default metadata field in Splunk that is automatically extracted at index time for every event. It is always present in the event data. The selected fields list only displays fields that the user has specifically chosen to show; if `source` is not visible there, it simply means the user has not added it to the selected fields. However, the field itself is always available. Therefore, the most likely reason the user does not see it in the list is that they have not selected it, but the field remains present in all events.

Answer

The search returned no results.

Answer

The user may have closed the field sidebar.

Answer

The `source` field is only available if explicitly extracted.

Question 4

An administrator wants to add a lookup table that maps user IDs to department names. The lookup file is a CSV with columns `user_id` and `department`. To use this lookup in searches, what must be configured?

Accepted Answer

Define a lookup definition in props.conf and transforms.conf.. To use a static CSV lookup in Splunk, you must upload the file to the lookups directory, then define a lookup stanza in transforms.conf specifying the filename and field mapping (e.g., `[users_lookup] filename = users.csv`). Optionally, you can create a lookup definition in props.conf for automatic field enrichment, but the lookup can be used manually via the `lookup` or `inputlookup` commands with just the transforms.conf entry. The key is that configuring both transforms.conf (mandatory) and props.conf (for automatic lookup) is the standard approach to fully integrate the lookup.

Answer

Define the lookup as a time-based lookup.

Answer

Define the lookup table file in the transforms.conf with a search string.

Answer

Upload the CSV to Splunk and it automatically becomes available.

Question 5

An analyst wants to automatically look up a field 'user_id' in a lookup file every time a search is run, without having to type the lookup command manually. Which approach is best?

Accepted Answer

Configure a lookup definition and set it as a default lookup for the index.. Automatic lookups are configured under Settings > Lookups > Automatic lookups. You define a lookup definition and then apply it to a specific source type or index, which causes the lookup to run automatically on every search matching that source type or index without requiring the manual `lookup` command. This is the intended method for automatic lookups in Splunk.

Answer

Add the lookup to the search command.

Answer

Create a regex extraction for user_id.

Answer

Use an alias to rename the field.

Question 6

Which TWO of the following must be true for the lookup to return results?

Accepted Answer

The events must contain a field named 'zip_code'.. The `lookup` command matches a field in the event data to a field in the lookup file. For the lookup to return results, the event must contain the field specified as the lookup input field (here, `zip_code`). Without this field in the events, there is no value to match against the lookup file, so no results are returned.

Answer

The events must contain a field named 'county'.

Answer

The lookup must be configured with `inputlookup` instead of `lookup`.

Answer

The lookup file must contain a field named 'city'.

Question 7

A security analyst is investigating a suspicious IP address. They want to find all events related to that IP. Which field should they use in a search?

Accepted Answer

source_ip. Source_ip. In Splunk, when investigating a suspicious IP address, the source_ip field identifies the origin of network traffic. By searching for source_ip=<suspicious IP>, you retrieve all events where that IP was the initiator of a connection, which is the most direct way to find events related to that IP in network logs.

Answer

dest_ip

Answer

host

Answer

user

Question 8

A Splunk admin wants to enrich web server logs with geographic location data based on IP addresses. Which approach should they use?

Accepted Answer

Configure a lookup definition and use lookup command. Splunk's lookup command, combined with a lookup definition that references a geographic IP-to-location database (such as MaxMind GeoLite2), allows the admin to enrich web server logs with fields like city, country, and coordinates based on the client IP address. This is the standard, efficient approach for IP geolocation enrichment in Splunk, as it leverages pre-built external data without requiring custom parsing or calculations.

Answer

Use rex to extract location from the IP

Answer

Use an eval command to calculate coordinates

Answer

Use fields command to add location

Question 9

A search returns many events but the 'status' field is missing from some events. The admin wants to set a default value of 'unknown' when the field is absent. Which command should be used?

Accepted Answer

fillnull value=unknown status. The `fillnull` command explicitly sets a default value for specified fields when they are null or missing in search results. In this scenario, `fillnull value=unknown status` replaces all null or absent 'status' field values with 'unknown', ensuring consistency across events. This command is designed specifically for handling missing field values in Splunk, unlike `eval` or `default` which operate differently.

Answer

eval status=coalesce(status, "unknown")

Answer

default status=unknown

Answer

replace status with "unknown"

Question 10

A user wants to see only events where the 'action' field has a value of 'success'. Which search syntax should they use?

Accepted Answer

action=success. In Splunk's Search Processing Language (SPL), a field-value pair like `action=success` is the most direct and efficient way to filter events where the field 'action' has the value 'success'. This syntax leverages Splunk's index-time field extraction and inverted index lookup, making it faster than using the `where` or `search` commands for simple equality filters.

Answer

where action=success

Answer

lookup action=success

Answer

search action=success

Question 11

A search includes a lookup that returns multiple values per event. The admin wants to see each matched value as a separate event. Which command should be used after the lookup?

Accepted Answer

mvexpand. The `mvexpand` command is correct because it takes a multivalue field (such as one created by a lookup returning multiple matches) and expands it into separate events, one for each value. This allows the admin to see each matched value as an individual event, which is exactly the requirement.

Answer

untable

Answer

stats

Answer

makemv

Question 12

In Splunk, which of the following is true about fields?

Accepted Answer

Fields are extracted at search time from raw data. In Splunk, fields are extracted at search time from raw data using the Search Processing Language (SPL) and the default field extraction rules. This allows Splunk to dynamically identify and index field-value pairs without requiring predefined schemas, enabling flexible ad-hoc analysis of unstructured or semi-structured data.

Answer

Fields must be manually defined before indexing

Answer

Fields are only available after using the fields command

Answer

All fields are predefined by Splunk

Question 13

An admin notices that a lookup is not returning any results for some events even though matching keys exist. What is the most likely cause?

Accepted Answer

The lookup is case-sensitive and the key values have different cases. Lookups in Splunk are case-sensitive by default. If the lookup file contains key values in a different case (e.g., 'ABC') than the event field values (e.g., 'abc'), the lookup will not match, even though the underlying data is logically equivalent. This is a common cause of lookup failures when the data sources have inconsistent casing.

Answer

The lookup field name is different from the event field name

Answer

The lookup is defined with the wrong field order

Answer

The time range of the search is too narrow

Question 14

A search uses a lookup that returns a field 'priority'. The admin wants to use the lookup only for events where the 'source' is 'firewall'. Which command should be used?

Accepted Answer

source=firewall | lookup priority_lookup source OUTPUT priority. It first filters events with `source=firewall` using a search-time field filter, then applies the `lookup` command only to those events. This ensures the lookup is performed exclusively on firewall events, minimizing resource usage and avoiding unnecessary lookups on other sources.

Answer

| lookup priority_lookup source OUTPUT priority

Answer

| lookup priority_lookup source OUTPUT priority | where source="firewall"

Answer

| lookup priority_lookup source OUTPUT priority WHERE source="firewall"

Question 15

Which of the following best describes the purpose of the 'fields' command in a search?

Accepted Answer

To keep or remove specified fields from events. The 'fields' command in Splunk is used to either keep (include) or remove (exclude) specified fields from search results. By default, all extracted fields are returned, but 'fields' allows you to narrow the output to only relevant fields (e.g., `fields clientip, status`) or to drop unwanted fields (e.g., `fields - _raw`). This improves readability and performance by reducing the data volume passed to subsequent commands.

Answer

To rename existing fields

Answer

To add fields from a lookup table

Answer

To extract new fields from raw data

Question 16

A user wants to create a field that contains the length of the 'message' field. Which command should they use?

Accepted Answer

eval msg_length=len(message). The `eval` command in Splunk is used to create or modify fields, and the `len()` function returns the character length of a string field. The syntax `eval msg_length=len(message)` creates a new field named `msg_length` containing the length of the `message` field.

Answer

rex field=message "(?<msg_length>.*)"

Answer

eval msg_length=sizeof(message)

Answer

len(message)

Question 17

Which TWO of the following are valid ways to extract fields in Splunk? (Choose two.)

Accepted Answer

Using the Extract New Fields dialog in the UI. The 'Extract New Fields' dialog in the Splunk UI provides a graphical interface to define field extractions using regex patterns, which are then saved as inline or custom field extractions. Option C is correct because the 'rex' command is a dedicated search-time command that extracts fields from raw event data using named capturing groups in a regular expression.

Answer

Using a lookup to extract fields from raw data

Answer

Using the fields command

Answer

Using the regex command in a search

Question 18

Which THREE of the following are true about lookups in Splunk? (Choose three.)

Accepted Answer

A lookup can be defined using a CSV file. Splunk allows you to define a lookup using a static CSV file stored in the lookups directory of an app. This CSV file acts as a lookup table that maps fields in your events to additional fields, enabling field enrichment without modifying the original data.

Answer

Lookups are case-insensitive by default

Answer

Lookups can only return a single field

Question 19

A Splunk admin wants to handle missing field values in a search. Which TWO SPL options can replace null values with a specified default? (Choose two.)

Accepted Answer

coalesce. The `fillnull` command explicitly replaces null field values with a specified default string (or '0' if no default is given). The `coalesce` function, used within an `eval` command, returns the first non-null value from a list of fields or expressions, effectively replacing nulls with a fallback default. Both commands directly address missing field values by substituting a specified default.

Answer

eval

Answer

convert

Answer

default

Question 20

Which THREE statements about the 'rex' command are correct? (Choose three.)

Accepted Answer

rex can be used to extract fields from any string field. The 'rex' command can extract fields from any string field, not just the default `_raw` field. By specifying the `field` argument, you can target any field containing string data, such as `field=uri_path` or `field=host`, and use a regular expression to extract new fields from its value.

Answer

rex can only extract one field per command

Answer

rex automatically converts extracted values to numeric