SPLK-1001 Using Fields and Lookups Practice Test 10 — 15 Questions

Question 1

A Splunk admin configured a CSV-based lookup to map device IP addresses to location data. The lookup 'devices.csv' has columns 'ip', 'building', 'floor'. In props.conf, they set: `LOOKUP-1 = devices ip OUTPUT building floor`. In transforms.conf: `[devices] filename = devices.csv`. The search over sourcetype 'network_logs' returns events with the 'ip' field, but 'building' and 'floor' are missing. The admin confirms the CSV file exists and has data. What is the most likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The props.conf LOOKUP-1 syntax is incorrect; the definition should be `LOOKUP-1 = devices` only, and the match/output fields should be defined in transforms.conf.. The `LOOKUP-1` definition in `props.conf` incorrectly includes the match and output fields. The correct syntax is `LOOKUP-1 = devices` only, with the match field (`ip`) and output fields (`building`, `floor`) defined in the `transforms.conf` stanza under `[devices]` using `external_type = csv`, `filename = devices.csv`, `match_type = WILDCARD(ip)`, and `default_match = NONE`. The admin's syntax causes Splunk to ignore the lookup configuration entirely, so no fields are added.

Answer

The CSV file is too large and the lookup is not being loaded.

Answer

The 'ip' field is not properly extracted from the sourcetype.

Answer

The lookup file is not accessible from the search head because it is stored on a different host.

Question 2

A large enterprise uses Splunk to monitor network traffic from thousands of devices. The events contain a field 'dest_ip' that you want to enrich with a company-specific asset owner and department. The asset data is stored in an SQL database that is updated daily. The Splunk administrator has set up a DB Connect app to query the database. However, the performance of the search is very slow when using dbquery to lookup asset information for each event. The team needs to improve performance while still maintaining daily updates. Which approach should the team take?

Accepted Answer

Use DB Connect to export the asset data to a CSV file or KV Store collection on a daily schedule, then use a CSV or KV Store lookup in searches. Exporting the asset data from the SQL database to a CSV file or KV Store collection on a daily schedule leverages the DB Connect app for bulk data transfer rather than per-event queries. This approach avoids the overhead of repeated dbquery calls during search time, which cause performance degradation. Using a CSV or KV Store lookup then provides fast, indexed lookups that can be refreshed daily to maintain data freshness.

Answer

Create a search-time field extraction that parses the dest_ip to derive owner and department

Answer

Increase the number of indexers to parallelize the lookup operations

Answer

Use the 'lookup' command with a KV Store lookup that is populated from the database in real time

Question 3

A Splunk user wants to see the list of fields that are defined in a lookup table named 'assets' without running a search. Which command should they use?

Accepted Answer

| inputlookup assets. The correct command is `| inputlookup assets` because it retrieves the contents of a lookup table named 'assets' without requiring a base search. This command is specifically designed to read lookup files directly, returning all fields and rows. It allows users to inspect the lookup table's schema and data without running a search over indexed data.

Answer

| lookup assets

Answer

| stats values(*) as * by *

Answer

| fields assets

Question 4

A security analyst is investigating a breach and needs to extract the 'user_id' field from raw log events. The logs contain both structured and unstructured data. The analyst uses the following search: `index=security sourcetype=syslog | rex field=_raw "user_id=(?<user_id>\w+)" | stats count by user_id`. However, some events do not contain the 'user_id' pattern, but they have a 'username' field extracted by a default extraction. The analyst wants to create a unified field 'user_id' that includes values from both. Which approach should the analyst take?

Accepted Answer

Use `eval user_id=coalesce(user_id, username)` to take the first non-null value. The `coalesce` function returns the first non-null value from a list of fields, making it ideal for merging `user_id` and `username` into a single unified field. Since `user_id` may be null in events where the regex extraction fails, `coalesce(user_id, username)` will use the `username` value as a fallback, ensuring all events contribute to the `stats count` without data loss.

Answer

Rename the 'username' field to 'user_id' using `rename username as user_id`

Answer

Use `eval user_id=mvindex(split(user_id+" "+username," "),0)` to combine the two fields

Answer

Use `fillnull value=N/A user_id` to handle missing values

Question 5

Which TWO of the following must be true for the lookup to return results?

Accepted Answer

The events must contain a field named 'zip_code'.. The `lookup` command matches a field in the event data to a field in the lookup file. For the lookup to return results, the event must contain the field specified as the lookup input field (here, `zip_code`). Without this field in the events, there is no value to match against the lookup file, so no results are returned.

Answer

The events must contain a field named 'county'.

Answer

The lookup must be configured with `inputlookup` instead of `lookup`.

Answer

The lookup file must contain a field named 'city'.

Question 6

A Splunk user runs a search that returns events with a field named 'src_ip'. They want to create a new field called 'attacker_ip' that always contains the same value as 'src_ip' without modifying the original field. Which of the following should they use?

Accepted Answer

A field alias created via Settings > Fields > Field aliases. A field alias is the correct mechanism to provide an alternate name for an existing field. It is configured in Settings and applies globally to the user or app context. The original field remains available, and the alias can be used interchangeably in searches, reports, and dashboards. This satisfies the requirement of creating a new field name without modifying the source field.

Answer

The rename command in the search pipeline

Answer

The eval command with the expression attacker_ip=src_ip

Answer

A calculated field created via Settings > Fields > Calculated fields

Question 7

A Splunk user needs to enrich events with department information from a CSV lookup file. The events contain a field 'employee_id', and the lookup file 'employees.csv' has columns 'employee_id' and 'department'. Which search command correctly adds the 'department' field to the events?

Accepted Answer

| lookup employees.csv employee_id OUTPUT department. The lookup command is designed to add fields from an external lookup table to events based on a matching field. The syntax specifies the lookup file, the field to match on, and the fields to output. This enriches each event with the department information without requiring a subsearch or complex join.

Answer

| inputlookup employees.csv employee_id OUTPUT department

Answer

| join employee_id [| inputlookup employees.csv]

Answer

| eval department = lookup(employees.csv, employee_id, department)

Question 8

A security analyst runs a search that returns events with a field named src_ip. The analyst wants to add a new field called attacker_ip that contains exactly the same value as src_ip, without removing or renaming src_ip, so that existing dashboards using src_ip continue to work. Which SPL command should the analyst use to accomplish this?

Accepted Answer

eval attacker_ip=src_ip. To add a new field that mirrors an existing field without removing the original, eval is the correct tool because it computes and assigns field values per event. Rename would replace the original field, fields only selects fields, and lookup requires an external table. Using eval preserves src_ip for existing dashboards while making attacker_ip available for new searches.

Answer

lookup src_ip AS attacker_ip

Answer

fields src_ip attacker_ip

Answer

rename src_ip AS attacker_ip

Question 9

A security analyst runs a search that returns events from a firewall sourcetype. The analyst wants to add a field called 'priority' to each event, using values stored in a CSV lookup file named 'priority_map.csv' that contains the fields 'severity' and 'priority'. The events already contain a 'severity' field. Which search command should the analyst use to add the 'priority' field to the events?

Accepted Answer

lookup priority_map.csv severity OUTPUT priority. The lookup command enriches events by matching event field values to a lookup table and adding specified output fields. Here, the event field 'severity' matches the lookup's 'severity' column, and the OUTPUT clause adds the 'priority' column to each event. This is the standard method for adding lookup-derived fields without altering the original event data or replacing the result set.

Answer

inputlookup priority_map.csv severity OUTPUT priority

Answer

lookup priority_map.csv severity AS priority

Answer

outputlookup priority_map.csv severity OUTPUT priority

Question 10

A Splunk administrator is configuring a knowledge object so that a field named 'clientip' in incoming events is automatically displayed as 'src' in searches without changing the raw event data or reindexing. The administrator wants the alias to apply to all events containing the clientip field. Which configuration should the administrator create?

Accepted Answer

A field alias that maps clientip to src. Field aliases are search-time knowledge objects that let one field name be used in place of another without altering raw events or requiring reindexing. Mapping clientip to src means that whenever clientip exists, searches can reference src and get the same value. Calculated fields and lookups serve different purposes, and reversing the alias direction would not make clientip appear as src.

Answer

A calculated field named clientip that returns src

Answer

A lookup definition named clientip that maps to src

Answer

A field alias that maps src to clientip

Question 11

A security analyst needs to enrich web proxy events by adding a department name to each event. The events already contain a field named 'src_user', and a CSV lookup named 'user_departments' contains the columns 'username' and 'department'. The analyst wants the department value added to every matching event without removing any existing fields. Which search command should the analyst use?

Accepted Answer

lookup user_departments username AS src_user OUTPUT department. The lookup command enriches events by matching event fields against lookup table columns. Because the event field is src_user and the lookup column is username, the AS clause is required to map them. OUTPUT department adds only the department field and preserves all existing fields, which matches the analyst's requirement exactly.

Answer

lookup user_departments username AS src_user REPLACE department

Answer

lookup user_departments src_user OUTPUT department

Answer

lookup user_departments username AS src_user OUTPUTNEW department

Question 12

A Splunk user has a lookup table named http_status.csv that maps HTTP status codes to descriptive text, with columns status_code and status_description. The user wants to enrich events that contain a field called status_code with the matching status_description from the lookup. Which SPL command should the user run?

Accepted Answer

lookup http_status status_code. The lookup command is designed to enrich events with fields from an external lookup table by matching on one or more fields. Specifying the lookup definition name and the matching field status_code causes Splunk to add the corresponding status_description from http_status.csv to each event. The other commands either read, write, or join data in ways that do not provide the required per-event enrichment.

Answer

inputlookup http_status.csv

Answer

join status_code

Answer

outputlookup http_status.csv

Question 13

A Splunk user has a CSV lookup file named 'employees.csv' with columns 'emp_id', 'full_name', and 'department'. The user wants to enrich events that contain an 'emp_id' field by adding the matching 'full_name' and 'department' values to each event. The lookup file is already uploaded and defined. Which SPL command should the user add to the search?

Accepted Answer

lookup employees emp_id. The lookup command enriches events by matching a field in the events against a lookup definition and appending the corresponding fields from the lookup table. It requires the lookup definition name, not the raw CSV file name. inputlookup retrieves lookup contents as results, and outputlookup writes results to a lookup, so neither performs event enrichment.

Answer

inputlookup employees emp_id

Answer

outputlookup employees emp_id

Answer

lookup employees.csv emp_id

Question 14

A Splunk user needs to create a lookup definition to enrich events with user details from a CSV file. Which two of the following are required steps to make the lookup available for use with the lookup command? (Choose two.)

Accepted Answer

Upload the CSV file to Splunk via Settings > Lookups > Lookup table files.. To use a CSV lookup, you must first upload the file to Splunk and then create a lookup definition that references it. The definition specifies the file and the fields to match, making the lookup available for the lookup command. Field aliases, sharing settings, and calculated fields are not prerequisites for basic lookup functionality.

Answer

Enable the lookup for the specific app and share it globally.

Answer

Create a field alias for the fields in the CSV file.

Answer

Define a calculated field that uses the lookup function.

Question 15

A security analyst runs a search that returns events from a web proxy sourcetype. The analyst needs to add the department name from a CSV lookup named 'departments.csv' to each event, matching on a field called 'src_user'. The lookup contains the columns 'src_user' and 'department'. Which search syntax will correctly enrich the events with the department field?

Accepted Answer

sourcetype=web_proxy | lookup departments.csv src_user OUTPUT department. The lookup command with a filename and a match field followed by OUTPUT is the standard method for enriching events with fields from a CSV lookup. It matches the event field 'src_user' to the lookup's 'src_user' column and appends only the specified 'department' field. This approach preserves the original events and adds the needed data efficiently.

Answer

sourcetype=web_proxy | join src_user [| lookup departments.csv]

Answer

sourcetype=web_proxy | inputlookup departments.csv src_user OUTPUT department

Answer

sourcetype=web_proxy | lookup departments.csv OUTPUT src_user, department