SPLK-1001 Using Fields and Lookups Practice Test 1 — 15 Questions

Question 1

A security analyst is investigating a suspicious IP address. They want to find all events related to that IP. Which field should they use in a search?

Accepted Answer

source_ip. Source_ip. In Splunk, when investigating a suspicious IP address, the source_ip field identifies the origin of network traffic. By searching for source_ip=<suspicious IP>, you retrieve all events where that IP was the initiator of a connection, which is the most direct way to find events related to that IP in network logs.

Answer

dest_ip

Answer

host

Answer

user

Question 2

A search returns many events but the 'status' field is missing from some events. The admin wants to set a default value of 'unknown' when the field is absent. Which command should be used?

Accepted Answer

fillnull value=unknown status. The `fillnull` command explicitly sets a default value for specified fields when they are null or missing in search results. In this scenario, `fillnull value=unknown status` replaces all null or absent 'status' field values with 'unknown', ensuring consistency across events. This command is designed specifically for handling missing field values in Splunk, unlike `eval` or `default` which operate differently.

Answer

eval status=coalesce(status, "unknown")

Answer

default status=unknown

Answer

replace status with "unknown"

Question 3

A user wants to see only events where the 'action' field has a value of 'success'. Which search syntax should they use?

Accepted Answer

action=success. In Splunk's Search Processing Language (SPL), a field-value pair like `action=success` is the most direct and efficient way to filter events where the field 'action' has the value 'success'. This syntax leverages Splunk's index-time field extraction and inverted index lookup, making it faster than using the `where` or `search` commands for simple equality filters.

Answer

where action=success

Answer

lookup action=success

Answer

search action=success

Question 4

A lookup table contains employee names and IDs. An admin wants to add the employee name to events that contain an employee ID field called 'emp_id'. What is the correct lookup command syntax?

Accepted Answer

| lookup employee_lookup emp_id OUTPUTNEW employee_name. The `OUTPUTNEW` clause in a lookup command only adds fields from the lookup table that are not already present in the event, preventing overwriting of existing field values. In this scenario, the admin wants to add the employee name to events that already contain an `emp_id` field, so `OUTPUTNEW employee_name` ensures the name is appended without modifying any existing data.

Answer

| lookup employee_lookup employee_name FROM emp_id

Answer

| lookup employee_lookup emp_id OUTPUTNEW *

Answer

| lookup employee_lookup emp_id OUTPUT employee_name

Question 5

An admin notices that a lookup is not returning any results for some events even though matching keys exist. What is the most likely cause?

Accepted Answer

The lookup is case-sensitive and the key values have different cases. Lookups in Splunk are case-sensitive by default. If the lookup file contains key values in a different case (e.g., 'ABC') than the event field values (e.g., 'abc'), the lookup will not match, even though the underlying data is logically equivalent. This is a common cause of lookup failures when the data sources have inconsistent casing.

Answer

The lookup field name is different from the event field name

Answer

The lookup is defined with the wrong field order

Answer

The time range of the search is too narrow

Question 6

A Splunk admin wants to handle missing field values in a search. Which TWO SPL options can replace null values with a specified default? (Choose two.)

Accepted Answer

coalesce. Option A, coalesce, is correct because it takes multiple field arguments and returns the first non-null value, so specifying a literal default as the last argument (e.g., coalesce(field, "N/A")) replaces nulls with that default. Option D, fillnull, is correct because it is purpose-built to replace null values in one or more fields with a specified value, as in fillnull value="N/A" field. Option B, eval, is not a dedicated null-replacement command; while an eval expression like if(isnull(field), "N/A", field) can achieve a similar result, eval itself is a general evaluation command, not an SPL option designed to replace nulls. Option C, convert, is used to convert field values to numeric or other formats and does not substitute defaults for missing values. Option E, default, is not a valid SPL command or function for replacing null values.

Answer

eval

Answer

convert

Answer

default

Question 7

Refer to the exhibit. A user gets this error when running a search with a GeoIP lookup. What is the most likely cause?

Accepted Answer

The lookup file has not been uploaded to Splunk. The error message indicates that Splunk cannot find the lookup table referenced in the search. Option C is correct because the GeoIP lookup file must be uploaded to Splunk (as a CSV or KMZ file) and defined as a lookup table in the lookups.conf configuration before it can be used in a search. Without the file being present in the system, the lookup command fails with a 'lookup table not found' error.

Answer

The user does not have permission to use lookups

Answer

The lookup command syntax is incorrect

Answer

The field name in the lookup does not match the event field

Question 8

A company has a Splunk environment indexing firewall logs from multiple vendors. The security team wants to enrich events with a threat intelligence lookup that contains IP addresses and threat categories. The lookup file 'threat_intel.csv' has fields: ip, category, confidence. The admin runs the following search: index=firewall | lookup threat_intel.csv src_ip OUTPUT category confidence. However, the lookup returns no results, even though there are matching IPs. The admin verifies that the lookup file is uploaded and the field names are correct. What is the most likely cause? The admin suspects that the lookup is case-sensitive, but the IP addresses in the logs are lowercase and the lookup has uppercase. The admin also considers that the lookup might be configured with the wrong field order, or that the lookup command is missing the OUTPUTNEW option, or that the index name is wrong. Which course of action should the admin take first to resolve the issue?

Accepted Answer

Modify the lookup definition to set case_sensitive_match = false. The most likely cause is that the lookup is case-sensitive by default, and the IP addresses in the logs are lowercase while the lookup file contains uppercase IPs. Setting `case_sensitive_match = false` in the lookup definition forces Splunk to ignore case when matching, which resolves the issue without altering the data or command structure.

Answer

Swap the field order in the lookup command

Answer

Change OUTPUT to OUTPUTNEW to avoid overwriting fields

Answer

Change the index to default

Question 9

A Splunk admin is tasked with creating a dashboard that shows the top 10 error codes from application logs. The logs contain a field 'error_code' which is extracted automatically. The admin writes the search: index=app sourcetype=app_log | top limit=10 error_code. The dashboard shows the correct data, but the admin wants to add a drilldown that passes the selected error code to another search. The admin considers using the 'fields' command to keep only error_code, the 'table' command to display the data, the 'eval' command to create a new field, or the 'stats' command to count. Which change should the admin make to the search to enable the drilldown functionality?

Accepted Answer

Replace top with table error_code, count. The `table` command produces a tabular output that inherently supports drilldown in Splunk dashboards by preserving the raw event data and field values. When you use `table error_code, count`, the dashboard can pass the selected `error_code` value to another search via a token. The original `top` command aggregates data into a statistical summary that does not retain the raw event structure required for standard drilldown behavior.

Answer

Add a stats count by error_code

Answer

Replace top with fields to keep only error_code

Answer

Add an eval command to create a clickable link

Question 10

A security analyst runs a search for failed logins and wants to display the source IP address, username, and count of failures. However, the field 'src_ip' is not showing in the field picker. Which of the following is the most likely reason?

Accepted Answer

The field is not extracted by default from the data source.. In Splunk, fields like 'src_ip' are not automatically extracted from raw event data unless the data source has a predefined source type that includes field extraction rules (e.g., via a technology add-on or custom regex). If the field does not appear in the field picker, it typically means the search has not extracted it from the raw events, so the analyst must use commands like `rex` or `extract` to parse it.

Answer

The field has no values in the results.

Answer

The user does not have permission to view the field.

Answer

The field name contains a typo.

Question 11

An organization is ingesting web proxy logs and wants to enrich them with a lookup table that maps internal IP addresses to employee names. The lookup table is updated weekly. Which configuration ensures the lookup is automatically applied to all searches without manual intervention, while also minimizing performance impact?

Accepted Answer

Configure an automatic lookup in props.conf and transforms.conf.. Configuring an automatic lookup in props.conf and transforms.conf allows the lookup to be applied at search time without requiring users to manually invoke the lookup command. This configuration minimizes performance impact by leveraging indexed field values and caching, and it ensures the lookup is automatically applied to all searches as soon as the lookup file is updated weekly.

Answer

Create a macro that includes the 'lookup' command and share it with users.

Answer

Upload the lookup file each week and manually run a search to add the field.

Answer

Use the 'lookup' command in every search to fetch the employee name.

Question 12

A user wants to replace a field value 'ERROR' with 'Error' in search results. Which command should be used within a search to achieve this transformation?

Accepted Answer

eval severity=replace(severity, "ERROR", "Error"). The `replace` function in the `eval` command performs a case-sensitive string replacement on a specific field. In this case, it replaces the exact string 'ERROR' with 'Error' in the `severity` field, which is the precise transformation requested. Unlike `rex`, `replace` does not require regex syntax and directly modifies the field value without affecting other parts of the event.

Answer

rex field=_raw 's/ERROR/Error/g'

Answer

lookup severity_lookup severity OUTPUT new_severity

Answer

convert ctime(_time)

Question 13

You are a Splunk admin for a large enterprise with multiple distributed Splunk components. The security team frequently runs searches that use a large CSV lookup file (500MB) containing threat intelligence indicators. They report that searches are slow and sometimes time out. The lookup file is updated hourly via an automated script. The team currently uses the 'lookup' command in every search. You need to improve performance without sacrificing data freshness. Your environment has a search head cluster and indexer cluster. The lookup file is stored on a shared filesystem accessible to all search heads. Which single approach will best improve search performance while maintaining hourly updates?

Accepted Answer

Configure the lookup as a time-based lookup with a filter condition to only apply to events with matching IP fields, and use automatic lookup to avoid manual command.. Configuring the lookup as a time-based lookup with a filter condition reduces the number of events that need to be matched against the 500MB CSV, and using an automatic lookup eliminates the need for the manual 'lookup' command in every search. This approach improves performance by limiting the lookup scope to relevant events (e.g., only those with matching IP fields) while still allowing the hourly script to update the CSV file, maintaining data freshness.

Answer

Increase the search concurrency limit on the search head to allow more parallel lookups.

Answer

Convert the CSV to a KV Store collection and use the 'lookup' command with the KV Store lookup.

Answer

Move the CSV file to each indexer and use index-time field lookup.

Question 14

A Splunk administrator configured an automatic lookup as shown. When searching index=main source=/var/log/auth.log, the department field is not populated. What is the most likely cause?

Accepted Answer

The match_type syntax is incorrect and the field mapping is mismatched.. The most common cause for a lookup not populating a field is a mismatch between the field mapping in the transforms.conf stanza and the actual field names in the lookup table. If the match_type syntax is incorrect (e.g., using WILDCARD instead of EXACT or specifying the wrong field name), Splunk will fail to match events to lookup entries, leaving the department field empty.

Answer

The LOOKUP- stanza requires a numeric priority.

Answer

The transforms.conf file is not in the correct directory.

Answer

The user_lookup.csv file does not exist in the lookups directory.

Question 15

Which three of the following are valid methods for creating or using field extractions in Splunk? (Choose three.)

Accepted Answer

Using the `| extract` command in a search to perform key-value pair extraction. The Field Extractor (FX) interactive tool is a valid method because it provides a GUI to generate regex-based extractions by highlighting sample data. Manually writing regular expressions in `props.conf` and `transforms.conf` is the standard way to define custom field extractions at the index-time or search-time level. The `| extract` command is valid because it performs key-value pair extraction on search results, typically for data formatted as `key=value` pairs, without requiring configuration files.

Answer

Configuring automatic field extraction via the `fieldaliases.conf` file

Answer

Using the `| fields` command to extract new fields from raw data

Answer

Using the `| rename` command to create new fields by renaming existing ones