Question 1easymultiple choice
Read the full Using Fields and Lookups explanation →SPLK-1002 Using Fields and Lookups • Complete Question Bank
Complete SPLK-1002 Using Fields and Lookups question bank — all 0 questions with answers and detailed explanations.
Refer to the exhibit. | inputlookup app_versions.csv | where version > "2.0" | table app version
Refer to the exhibit. Error message: "Lookup table 'geoip' not found in 'lookups' directory."
Refer to the exhibit. index=web sourcetype=access_combined | top 5 uri
Refer to the exhibit. # /opt/splunk/etc/system/local/transforms.conf [user_lookup] filename = users.csv match_type = WILDCARD(user_name) # /opt/splunk/etc/system/local/props.conf [source::/var/log/auth.log] LOOKUP-user = user_lookup user_name AS username OUTPUTNEW department
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag a concept onto its matching description — or click a concept then click the description.
Define how to extract fields from raw data
A search that is persisted and can be scheduled
Saved search with visualization or statistics
Saved search that triggers actions on conditions
Collection of panels with saved searches or reports
Drag a concept onto its matching description — or click a concept then click the description.
Optimizes for speed, minimal fields and events
Adjusts automatically based on search complexity
Returns all fields and events for maximum detail
Refer to the exhibit. props.conf: [apache_error] FIELDALIAS-error_code = error_id AS error_code Transforms.conf: [error_code_lookup] filename = error_codes.csv Search: index=web sourcetype=apache_error | lookup error_code_lookup error_id OUTPUT error_description The search returns no results from the lookup. What is the most likely issue?
Refer to the exhibit. automatic_lookups.conf: [apache_access] lookup_table = geoip GeoIP lookup file has fields: ip, city, country The search: index=web sourcetype=apache_access | head 10 Results show city and country fields with correct values from the GeoIP lookup. However, the search also shows the raw field 'clientip'. What does the automatic lookup do with the input field?
Refer to the exhibit. Search: index=main | eval priority = case(error = "critical", 1, error = "warning", 2, 1=1, 3) | stats count by priority Results show priority values 1, 2, and 3. What would happen if the eval statement was changed to: eval priority = case(error = "critical", 1, error = "warning", 2, true(), 3)?
[excel_lookup] filename = sales_data.csv max_matches = 1 default_match = N/A case_sensitive_match = true
| inputlookup usertable | where role="admin" | stats count by department
[automatic_lookup] filename = dept_table.csv match_type = WILDCARD(employee_id)
Refer to the exhibit. search command: `index=web sourcetype=access | lookup geo_ip.csv clientip OUTPUT country region city` Exhibit shows the first few lines of the geo_ip.csv file: clientip,country,region,city 10.0.0.1,USA,CA,San Francisco 10.0.0.2,USA,NY,New York 10.0.0.3,CAN,ON,Toronto
Refer to the exhibit. Search: `index=main sourcetype=syslog | eval match_field=src_ip | lookup application_map.csv match_field OUTPUTNEW app_name` Exhibit shows the lookup definition: [lookup_application_map] filename = application_map.csv match_type = WILDCARD(app_name)
Refer to the exhibit. Lookup definition in transforms.conf: [user_lookup] filename = users.csv match_type = EXACT(user_id) max_matches = 1 Search: `index=main | lookup user_lookup user_id OUTPUT first_name last_name | where isnotnull(first_name) | stats count by user_id`
[my_lookup] filename = my_lookup.csv max_matches = 5 default_match = UNKNOWN case_sensitive_match = true
> splunk add lookup-table my_lookup my_lookup.csv
index=main | rex field=_raw "(?<ip>\d+\.\d+\.\d+\.\d+)" | lookup country_lookup ip OUTPUT country
Refer to the exhibit. Search: ``` index=main sourcetype=vendor_sales | lookup region_lookup zip_code OUTPUT city, state | stats count by city ``` Lookup definition: `region_lookup` is a CSV file with columns: `zip_code`, `city`, `state`, `population`.