SPLK-1001 Using Fields and Lookups — 50 Questions

Question 1

A security analyst is investigating a suspicious IP address. They want to find all events related to that IP. Which field should they use in a search?

Accepted Answer

source_ip. Source_ip. In Splunk, when investigating a suspicious IP address, the source_ip field identifies the origin of network traffic. By searching for source_ip=<suspicious IP>, you retrieve all events where that IP was the initiator of a connection, which is the most direct way to find events related to that IP in network logs.

Answer

dest_ip

Answer

host

Answer

user

Question 2

A search returns many events but the 'status' field is missing from some events. The admin wants to set a default value of 'unknown' when the field is absent. Which command should be used?

Accepted Answer

fillnull value=unknown status. The `fillnull` command explicitly sets a default value for specified fields when they are null or missing in search results. In this scenario, `fillnull value=unknown status` replaces all null or absent 'status' field values with 'unknown', ensuring consistency across events. This command is designed specifically for handling missing field values in Splunk, unlike `eval` or `default` which operate differently.

Answer

eval status=coalesce(status, "unknown")

Answer

default status=unknown

Answer

replace status with "unknown"

Question 3

A user wants to see only events where the 'action' field has a value of 'success'. Which search syntax should they use?

Accepted Answer

action=success. In Splunk's Search Processing Language (SPL), a field-value pair like `action=success` is the most direct and efficient way to filter events where the field 'action' has the value 'success'. This syntax leverages Splunk's index-time field extraction and inverted index lookup, making it faster than using the `where` or `search` commands for simple equality filters.

Answer

where action=success

Answer

lookup action=success

Answer

search action=success

Question 4

A lookup table contains employee names and IDs. An admin wants to add the employee name to events that contain an employee ID field called 'emp_id'. What is the correct lookup command syntax?

Accepted Answer

| lookup employee_lookup emp_id OUTPUTNEW employee_name. The `OUTPUTNEW` clause in a lookup command only adds fields from the lookup table that are not already present in the event, preventing overwriting of existing field values. In this scenario, the admin wants to add the employee name to events that already contain an `emp_id` field, so `OUTPUTNEW employee_name` ensures the name is appended without modifying any existing data.

Answer

| lookup employee_lookup employee_name FROM emp_id

Answer

| lookup employee_lookup emp_id OUTPUTNEW *

Answer

| lookup employee_lookup emp_id OUTPUT employee_name

Question 5

An admin notices that a lookup is not returning any results for some events even though matching keys exist. What is the most likely cause?

Accepted Answer

The lookup is case-sensitive and the key values have different cases. Lookups in Splunk are case-sensitive by default. If the lookup file contains key values in a different case (e.g., 'ABC') than the event field values (e.g., 'abc'), the lookup will not match, even though the underlying data is logically equivalent. This is a common cause of lookup failures when the data sources have inconsistent casing.

Answer

The lookup field name is different from the event field name

Answer

The lookup is defined with the wrong field order

Answer

The time range of the search is too narrow

Question 6

A Splunk admin wants to handle missing field values in a search. Which TWO SPL options can replace null values with a specified default? (Choose two.)

Accepted Answer

coalesce. Option A, coalesce, is correct because it takes multiple field arguments and returns the first non-null value, so specifying a literal default as the last argument (e.g., coalesce(field, "N/A")) replaces nulls with that default. Option D, fillnull, is correct because it is purpose-built to replace null values in one or more fields with a specified value, as in fillnull value="N/A" field. Option B, eval, is not a dedicated null-replacement command; while an eval expression like if(isnull(field), "N/A", field) can achieve a similar result, eval itself is a general evaluation command, not an SPL option designed to replace nulls. Option C, convert, is used to convert field values to numeric or other formats and does not substitute defaults for missing values. Option E, default, is not a valid SPL command or function for replacing null values.

Answer

eval

Answer

convert

Answer

default

Question 7

Refer to the exhibit. A user gets this error when running a search with a GeoIP lookup. What is the most likely cause?

Accepted Answer

The lookup file has not been uploaded to Splunk. The error message indicates that Splunk cannot find the lookup table referenced in the search. Option C is correct because the GeoIP lookup file must be uploaded to Splunk (as a CSV or KMZ file) and defined as a lookup table in the lookups.conf configuration before it can be used in a search. Without the file being present in the system, the lookup command fails with a 'lookup table not found' error.

Answer

The user does not have permission to use lookups

Answer

The lookup command syntax is incorrect

Answer

The field name in the lookup does not match the event field

Question 8

A company has a Splunk environment indexing firewall logs from multiple vendors. The security team wants to enrich events with a threat intelligence lookup that contains IP addresses and threat categories. The lookup file 'threat_intel.csv' has fields: ip, category, confidence. The admin runs the following search: index=firewall | lookup threat_intel.csv src_ip OUTPUT category confidence. However, the lookup returns no results, even though there are matching IPs. The admin verifies that the lookup file is uploaded and the field names are correct. What is the most likely cause? The admin suspects that the lookup is case-sensitive, but the IP addresses in the logs are lowercase and the lookup has uppercase. The admin also considers that the lookup might be configured with the wrong field order, or that the lookup command is missing the OUTPUTNEW option, or that the index name is wrong. Which course of action should the admin take first to resolve the issue?

Accepted Answer

Modify the lookup definition to set case_sensitive_match = false. The most likely cause is that the lookup is case-sensitive by default, and the IP addresses in the logs are lowercase while the lookup file contains uppercase IPs. Setting `case_sensitive_match = false` in the lookup definition forces Splunk to ignore case when matching, which resolves the issue without altering the data or command structure.

Answer

Swap the field order in the lookup command

Answer

Change OUTPUT to OUTPUTNEW to avoid overwriting fields

Answer

Change the index to default

Question 9

A Splunk admin is tasked with creating a dashboard that shows the top 10 error codes from application logs. The logs contain a field 'error_code' which is extracted automatically. The admin writes the search: index=app sourcetype=app_log | top limit=10 error_code. The dashboard shows the correct data, but the admin wants to add a drilldown that passes the selected error code to another search. The admin considers using the 'fields' command to keep only error_code, the 'table' command to display the data, the 'eval' command to create a new field, or the 'stats' command to count. Which change should the admin make to the search to enable the drilldown functionality?

Accepted Answer

Replace top with table error_code, count. The `table` command produces a tabular output that inherently supports drilldown in Splunk dashboards by preserving the raw event data and field values. When you use `table error_code, count`, the dashboard can pass the selected `error_code` value to another search via a token. The original `top` command aggregates data into a statistical summary that does not retain the raw event structure required for standard drilldown behavior.

Answer

Add a stats count by error_code

Answer

Replace top with fields to keep only error_code

Answer

Add an eval command to create a clickable link

Question 10

A security analyst runs a search for failed logins and wants to display the source IP address, username, and count of failures. However, the field 'src_ip' is not showing in the field picker. Which of the following is the most likely reason?

Accepted Answer

The field is not extracted by default from the data source.. In Splunk, fields like 'src_ip' are not automatically extracted from raw event data unless the data source has a predefined source type that includes field extraction rules (e.g., via a technology add-on or custom regex). If the field does not appear in the field picker, it typically means the search has not extracted it from the raw events, so the analyst must use commands like `rex` or `extract` to parse it.

Answer

The field has no values in the results.

Answer

The user does not have permission to view the field.

Answer

The field name contains a typo.

Question 11

An organization is ingesting web proxy logs and wants to enrich them with a lookup table that maps internal IP addresses to employee names. The lookup table is updated weekly. Which configuration ensures the lookup is automatically applied to all searches without manual intervention, while also minimizing performance impact?

Accepted Answer

Configure an automatic lookup in props.conf and transforms.conf.. Configuring an automatic lookup in props.conf and transforms.conf allows the lookup to be applied at search time without requiring users to manually invoke the lookup command. This configuration minimizes performance impact by leveraging indexed field values and caching, and it ensures the lookup is automatically applied to all searches as soon as the lookup file is updated weekly.

Answer

Create a macro that includes the 'lookup' command and share it with users.

Answer

Upload the lookup file each week and manually run a search to add the field.

Answer

Use the 'lookup' command in every search to fetch the employee name.

Question 12

A user wants to replace a field value 'ERROR' with 'Error' in search results. Which command should be used within a search to achieve this transformation?

Accepted Answer

eval severity=replace(severity, "ERROR", "Error"). The `replace` function in the `eval` command performs a case-sensitive string replacement on a specific field. In this case, it replaces the exact string 'ERROR' with 'Error' in the `severity` field, which is the precise transformation requested. Unlike `rex`, `replace` does not require regex syntax and directly modifies the field value without affecting other parts of the event.

Answer

rex field=_raw 's/ERROR/Error/g'

Answer

lookup severity_lookup severity OUTPUT new_severity

Answer

convert ctime(_time)

Question 13

You are a Splunk admin for a large enterprise with multiple distributed Splunk components. The security team frequently runs searches that use a large CSV lookup file (500MB) containing threat intelligence indicators. They report that searches are slow and sometimes time out. The lookup file is updated hourly via an automated script. The team currently uses the 'lookup' command in every search. You need to improve performance without sacrificing data freshness. Your environment has a search head cluster and indexer cluster. The lookup file is stored on a shared filesystem accessible to all search heads. Which single approach will best improve search performance while maintaining hourly updates?

Accepted Answer

Configure the lookup as a time-based lookup with a filter condition to only apply to events with matching IP fields, and use automatic lookup to avoid manual command.. Configuring the lookup as a time-based lookup with a filter condition reduces the number of events that need to be matched against the 500MB CSV, and using an automatic lookup eliminates the need for the manual 'lookup' command in every search. This approach improves performance by limiting the lookup scope to relevant events (e.g., only those with matching IP fields) while still allowing the hourly script to update the CSV file, maintaining data freshness.

Answer

Increase the search concurrency limit on the search head to allow more parallel lookups.

Answer

Convert the CSV to a KV Store collection and use the 'lookup' command with the KV Store lookup.

Answer

Move the CSV file to each indexer and use index-time field lookup.

Question 14

A Splunk administrator configured an automatic lookup as shown. When searching index=main source=/var/log/auth.log, the department field is not populated. What is the most likely cause?

Accepted Answer

The match_type syntax is incorrect and the field mapping is mismatched.. The most common cause for a lookup not populating a field is a mismatch between the field mapping in the transforms.conf stanza and the actual field names in the lookup table. If the match_type syntax is incorrect (e.g., using WILDCARD instead of EXACT or specifying the wrong field name), Splunk will fail to match events to lookup entries, leaving the department field empty.

Answer

The LOOKUP- stanza requires a numeric priority.

Answer

The transforms.conf file is not in the correct directory.

Answer

The user_lookup.csv file does not exist in the lookups directory.

Question 15

Which three of the following are valid methods for creating or using field extractions in Splunk? (Choose three.)

Accepted Answer

Using the `| extract` command in a search to perform key-value pair extraction. The Field Extractor (FX) interactive tool is a valid method because it provides a GUI to generate regex-based extractions by highlighting sample data. Manually writing regular expressions in `props.conf` and `transforms.conf` is the standard way to define custom field extractions at the index-time or search-time level. The `| extract` command is valid because it performs key-value pair extraction on search results, typically for data formatted as `key=value` pairs, without requiring configuration files.

Answer

Using the `| rename` command to create new fields by renaming existing ones

Answer

Configuring automatic field extraction via the `fieldaliases.conf` file

Answer

Using the `| fields` command to extract new fields from raw data

Question 16

Which three of the following statements about lookup tables and their usage in Splunk are correct? (Choose three.)

Accepted Answer

A lookup table can be defined as a CSV file stored in the lookups directory of an app. The first three statements are correct. Lookup tables can be defined as CSV files stored in the lookups directory of an app, which is a standard method for creating static lookups. The `| inputlookup` command retrieves and returns the contents of a lookup table as search results, allowing you to inspect or use the data. Lookups can be configured to automatically enrich events during search time using the `lookup` command, which matches fields in events against the lookup table to add additional fields.

Answer

Lookup table files must always have a .csv extension and cannot be in other formats like .kvstore

Answer

The `| outputlookup` command is used to append data to an existing lookup file without any limitations

Answer

Lookups can only match on a single field; using multiple fields requires creating separate lookups

Question 17

Which of the following are true statements about using fields and lookups in Splunk? Choose all that apply. (There are four correct answers.)

Accepted Answer

A lookup table can be used to add fields to events based on a match between a field in the event and a field in the lookup file.. The first option is correct because lookup tables in Splunk allow you to add fields to events by matching a field in the event with a field in the lookup file, enriching the data. The second option is correct because the `| lookup` command supports both CSV files and KV store collections, enabling flexible data enrichment. The fourth option is correct because geospatial lookups require latitude and longitude coordinates and are used with the `| geom` command for map visualizations. The fifth option is correct because `| inputlookup` loads the entire lookup file into search results, allowing direct inspection or aggregation of lookup data.

Answer

Extracted fields using the `| rex` command are automatically added to the field sidebar and can be used in searches without any additional configuration.

Answer

Field aliases defined in props.conf can rename a field in search results without altering the raw data, but they are not applied retroactively to events indexed in the past.

Question 18

Drag and drop the steps to create a simple Splunk search that returns results for a specific error in the last 24 hours into the correct order.

Accepted Answer

Select the Search & Reporting app, Enter the search query for the error, Set the time range to Last 24 hours, Run the search.. Basic search workflow involves selecting the app, entering the search with time range, executing, and reviewing results.

Answer

Set the time range to Last 24 hours, Select the Search & Reporting app, Enter the search query for the error, Run the search.

Answer

Enter the search query for the error, Select the Search & Reporting app, Set the time range to Last 24 hours, Run the search.

Answer

Select the Search & Reporting app, Set the time range to Last 24 hours, Run the search, Enter the search query for the error.

Question 19

Match each knowledge object to its definition.

Accepted Answer

Event: A single record of data that represents an occurrence in a system. The correct matches are: Event (single record), Index (data repository), Report (saved search/visualization), Alert (scheduled search with actions), Field (extracted name-value pair). Common confusions include swapping Index with Report or Event with Indexer Cluster.

Answer

Event: A collection of indexers that process and store data

Answer

Index: A saved search that generates a list of events that satisfy certain criteria

Answer

Report: A field extraction that automatically identifies key-value pairs in raw data

Answer

Alert: A dashboard panel that displays real-time data from a saved search

Answer

Field: A collection of events grouped by a common timestamp or source

Question 20

An analyst runs a search and needs to view only events where the 'status' field has a value of 'failed'. Which command should be used?

Accepted Answer

where status = "failed". The `where` command in Splunk allows you to filter events based on a field value using a comparison expression. In this case, `where status = "failed"` evaluates each event and retains only those where the `status` field exactly matches the string "failed". This is the appropriate command when you need to filter results after the initial search has already been run, or when you need to use comparison operators that are not available in the `search` command.

Answer

table status

Answer

search status=failed

Answer

eval status = "failed"