SPLK-1001 Using Fields and Lookups Practice Test 2 — 15 Questions

Question 1

Which three of the following statements about lookup tables and their usage in Splunk are correct? (Choose three.)

Accepted Answer

A lookup table can be defined as a CSV file stored in the lookups directory of an app. The first three statements are correct. Lookup tables can be defined as CSV files stored in the lookups directory of an app, which is a standard method for creating static lookups. The `| inputlookup` command retrieves and returns the contents of a lookup table as search results, allowing you to inspect or use the data. Lookups can be configured to automatically enrich events during search time using the `lookup` command, which matches fields in events against the lookup table to add additional fields.

Answer

Lookup table files must always have a .csv extension and cannot be in other formats like .kvstore

Answer

The `| outputlookup` command is used to append data to an existing lookup file without any limitations

Answer

Lookups can only match on a single field; using multiple fields requires creating separate lookups

Question 2

Which of the following are true statements about using fields and lookups in Splunk? Choose all that apply. (There are four correct answers.)

Accepted Answer

Geospatial lookups require the lookup file to contain latitude and longitude coordinates and are typically used with the `| geom` command to visualize data on a map.. The first option is correct because lookup tables in Splunk allow you to add fields to events by matching a field in the event with a field in the lookup file, enriching the data. The second option is correct because the `| lookup` command supports both CSV files and KV store collections, enabling flexible data enrichment. The fourth option is correct because geospatial lookups require latitude and longitude coordinates and are used with the `| geom` command for map visualizations. The fifth option is correct because `| inputlookup` loads the entire lookup file into search results, allowing direct inspection or aggregation of lookup data.

Answer

Field aliases defined in props.conf can rename a field in search results without altering the raw data, but they are not applied retroactively to events indexed in the past.

Answer

Extracted fields using the `| rex` command are automatically added to the field sidebar and can be used in searches without any additional configuration.

Question 3

Drag and drop the steps to create a simple Splunk search that returns results for a specific error in the last 24 hours into the correct order.

Accepted Answer

Select the Search & Reporting app, Enter the search query for the error, Set the time range to Last 24 hours, Run the search.. Basic search workflow involves selecting the app, entering the search with time range, executing, and reviewing results.

Answer

Set the time range to Last 24 hours, Select the Search & Reporting app, Enter the search query for the error, Run the search.

Answer

Enter the search query for the error, Select the Search & Reporting app, Set the time range to Last 24 hours, Run the search.

Answer

Select the Search & Reporting app, Set the time range to Last 24 hours, Run the search, Enter the search query for the error.

Question 4

Match each knowledge object to its definition.

Accepted Answer

Event: A single record of data that represents an occurrence in a system. The correct matches are: Event (single record), Index (data repository), Report (saved search/visualization), Alert (scheduled search with actions), Field (extracted name-value pair). Common confusions include swapping Index with Report or Event with Indexer Cluster.

Answer

Event: A collection of indexers that process and store data

Answer

Index: A saved search that generates a list of events that satisfy certain criteria

Answer

Report: A field extraction that automatically identifies key-value pairs in raw data

Answer

Alert: A dashboard panel that displays real-time data from a saved search

Answer

Field: A collection of events grouped by a common timestamp or source

Question 5

An analyst runs a search and needs to view only events where the 'status' field has a value of 'failed'. Which command should be used?

Accepted Answer

where status = "failed". The `where` command in Splunk allows you to filter events based on a field value using a comparison expression. In this case, `where status = "failed"` evaluates each event and retains only those where the `status` field exactly matches the string "failed". This is the appropriate command when you need to filter results after the initial search has already been run, or when you need to use comparison operators that are not available in the `search` command.

Answer

table status

Answer

search status=failed

Answer

eval status = "failed"

Question 6

A team has a lookup table 'app_errors.csv' that includes a field 'error_code'. They want to automatically join error descriptions from 'error_codes.csv' on 'error_code' every time they search a sourcetype. What is the best way to achieve this?

Accepted Answer

Set up an automatic lookup in props.conf for the sourcetype. An automatic lookup in props.conf allows you to define a lookup that runs automatically on every search for a given sourcetype, without requiring manual invocation. This configuration joins the 'error_code' field from the search results with the 'error_codes.csv' lookup table, appending the description field to every event of that sourcetype. It is the most efficient and consistent method for automatically enriching data at search time.

Answer

Use an eval statement with if() to assign description

Answer

Configure field aliases to rename 'error_code'

Answer

Use the lookup command in every search

Question 7

An organization uses a KV Store lookup to maintain a list of known malicious IPs. The lookup is updated every 5 minutes via a script. Analysts complain that their searches sometimes miss recent additions. What is the most likely cause?

Accepted Answer

The KV Store lookup is cached and not refreshed between searches. The most likely cause is that the KV Store lookup is cached. By default, KV Store lookups are cached per search and only refreshed when the cache expires or at the start of a new search. If analysts run searches within the same cache duration, they may miss recent updates. Option A is not applicable because KV Store lookups are not time-based in the same way as time-based lookups. Option B is incorrect because IP addresses are not case-sensitive; lookup matching is case-insensitive by default. Option C is incorrect because the _raw field is unrelated to lookup functionality. Therefore, the correct answer is D.

Answer

The lookup is configured as time-based and is out of range

Answer

The IP addresses are case-sensitive and messy

Answer

The search does not include the _raw field

Question 8

A user has a search that produces a chart of error counts by host. They want to add a calculated field 'error_rate' as errors per million events. Which approach is correct?

Accepted Answer

Use eventstats to get total counts, then eval to compute rate, then chart. It uses `eventstats` to compute the total count of events per host across the entire result set, then `eval` to calculate the error rate as (error_count / total_count) * 1,000,000, and finally `chart` to display the results. This two-step approach ensures the total count is available for each row before the rate calculation, which is necessary because `chart` alone cannot reference a field computed in the same command.

Answer

Use chart eval(error_count/total_count) by host

Answer

Use stats to compute error_rate directly: stats avg(error_rate) by host

Answer

Use the lookup command to apply a calculated field

Question 9

Which TWO of the following are valid ways to create a field alias in Splunk?

Accepted Answer

Use the INDEXED_EXTRACTIONS setting with an alias directive. The INDEXED_EXTRACTIONS setting in props.conf can include an alias directive (e.g., `alias::=`) to define field aliases directly at index time. This allows you to map an extracted field to an alternative name without modifying the raw data or using search-time operations.

Answer

Use eval to assign a field to another field name

Answer

Use the rename command in a saved search

Answer

Use the aliases command in a search

Question 10

Which THREE of the following are valid options for the lookup command?

Accepted Answer

local=. The `local=` parameter in the lookup command specifies whether the lookup should be performed on the search head (local) or distributed across indexers. When set to `true`, the lookup file is read from the search head; when `false`, it is distributed to all indexers, which is critical for performance in large environments.

Answer

rename <field> as <alias>

Answer

join <field>

Question 11

Refer to the exhibit. The search returns no results from the lookup. What is the most likely issue?

Accepted Answer

The lookup command references 'error_id' but the alias changed the field to 'error_code'. The search uses `lookup error_codes.csv error_id` but the FIELDALIAS in props.conf has renamed the field `error_id` to `error_code`. Since the lookup command references the original field name `error_id`, which no longer exists in the events after alias processing, the lookup cannot match any values and returns no results.

Answer

The FIELDALIAS syntax is incorrect

Answer

The lookup table is not defined in transforms.conf

Answer

The lookup file 'error_codes.csv' does not exist

Question 12

Refer to the exhibit. The search results show city and country fields from the GeoIP lookup. What does the automatic lookup use as the input field to match against the lookup table?

Accepted Answer

ip. The automatic GeoIP lookup in Splunk uses the `ip` field as the default input field to match against the lookup table. This is because the GeoIP lookup is designed to map IP addresses to geographic locations, and the lookup table expects an IP address as the key. When you configure an automatic lookup, you specify the input field (e.g., `ip`) that corresponds to the lookup table's key field, allowing Splunk to enrich events with location data.

Answer

All fields in the event

Answer

No input field, it directly appends all lookup fields

Answer

clientip

Question 13

Refer to the exhibit. What would happen if the eval statement was changed to: eval priority = case(error = "critical", 1, error = "warning", 2, true(), 3)?

Accepted Answer

All events are assigned priority 1. Using assignment `=` instead of comparison `==` in the `case` function causes each condition to evaluate as an assignment. In Splunk eval, assignment returns the assigned value, which is truthy for non-empty strings. The first condition `error = "critical"` is always true, so the first branch is taken for every event, setting `priority=1`. Consequently, the search returns results where every event has priority 1, which differs from the original output where priorities varied. No syntax error occurs.

Answer

The search returns no results

Answer

The search only returns priority 3

Answer

The search returns a syntax error

Question 14

A user runs a search for errors but notices that the `source` field is not appearing in the selected fields list. What is the most likely reason?

Accepted Answer

The field `source` is a default field and is always present.. Although the user reports that the `source` field is not appearing in the selected fields list, the `source` field is indeed a default metadata field in Splunk that is automatically extracted at index time for every event. It is always present in the event data. The selected fields list only displays fields that the user has specifically chosen to show; if `source` is not visible there, it simply means the user has not added it to the selected fields. However, the field itself is always available. Therefore, the most likely reason the user does not see it in the list is that they have not selected it, but the field remains present in all events.

Answer

The search returned no results.

Answer

The user may have closed the field sidebar.

Answer

The `source` field is only available if explicitly extracted.

Question 15

An administrator wants to add a lookup table that maps user IDs to department names. The lookup file is a CSV with columns `user_id` and `department`. To use this lookup in searches, what must be configured?

Accepted Answer

Define a lookup definition in props.conf and transforms.conf.. To use a static CSV lookup in Splunk, you must upload the file to the lookups directory, then define a lookup stanza in transforms.conf specifying the filename and field mapping (e.g., `[users_lookup] filename = users.csv`). Optionally, you can create a lookup definition in props.conf for automatic field enrichment, but the lookup can be used manually via the `lookup` or `inputlookup` commands with just the transforms.conf entry. The key is that configuring both transforms.conf (mandatory) and props.conf (for automatic lookup) is the standard approach to fully integrate the lookup.

Answer

Define the lookup as a time-based lookup.

Answer

Define the lookup table file in the transforms.conf with a search string.

Answer

Upload the CSV to Splunk and it automatically becomes available.