SPLK-1001 Using Fields and Lookups Practice Test 3 — 15 Questions

Question 1

Which command is used to import an external CSV file into a Splunk lookup table for the first time?

Accepted Answer

`| outputlookup`. The `| outputlookup` command is used to create or overwrite a lookup table file in Splunk from search results. When importing an external CSV file into a Splunk lookup table for the first time, you would first ingest the CSV data (e.g., via `| inputcsv` or by uploading the file), then use `| outputlookup` to write that data into a lookup definition that Splunk can reference.

Answer

`| lookup`

Answer

`| inputlookup`

Answer

`| fields`

Question 2

A user wants to see the values of all fields in an event, including fields that are not automatically extracted. Which search command should be used?

Accepted Answer

`| table *`. The `| table *` command displays all fields in each event, including those not automatically extracted, by listing every field in a tabular format. This is because the asterisk wildcard in `table` includes all fields present in the search results, regardless of whether they are extracted by default or through custom parsing. In contrast, `| fields *` only retains fields that are already known to the search index, not necessarily showing all raw event data.

Answer

`| rex`

Answer

`| fields *`

Answer

`| spath`

Question 3

A user creates a calculated field that extracts the domain from email addresses using the expression `| rex field=email "(?P<domain>@\w+\.\w+)"`. However, the calculated field does not appear in search results. What is the most likely reason?

Accepted Answer

Calculated fields must be enabled in props.conf with REPORT clauses.. Calculated fields in Splunk require explicit configuration in props.conf using a REPORT clause to define the extraction. Without this configuration, the calculated field is not available for use in searches, even if the extraction expression is valid. The user's calculated field definition is missing the necessary props.conf setup, so it never gets applied.

Answer

Calculated fields are only applied at search time, not index time.

Answer

The field extraction is incorrect.

Answer

Calculated fields must be used with the `eval` command.

Question 4

An automatic lookup is configured but it is not enriching events. The lookup file is large (100MB) and is updated daily. What setting could improve performance?

Accepted Answer

Enable `batch_index_lookup = true`. Enabling `batch_index_lookup = true` in transforms.conf allows Splunk to process the entire 100MB lookup file in a single batch operation rather than performing individual lookups for each event. This significantly reduces I/O overhead and improves performance for large, daily-updated lookup files by loading the entire lookup into memory once per batch.

Answer

Set `filter` in transforms.conf

Answer

Increase `max_matches`

Answer

Use `| lookup` instead of automatic

Question 5

Refer to the exhibit. A user runs a search with `| lookup excel_lookup product_id OUTPUT sales_rep`. For a product_id that exists in the CSV but with a different case (e.g., "ABC123" vs "abc123"), what will be the value of the `sales_rep` field after the lookup?

Accepted Answer

"N/A" because the case does not match and default_match is set.. The `| lookup` command in Splunk is case-sensitive by default. When the product_id in the event has a different case than the lookup file, the lookup fails to find a match. If the lookup definition has `default_match` set to a value like 'N/A', that default value is returned for the `sales_rep` field instead of the actual lookup value.

Answer

The correct sales_rep from the lookup.

Answer

An error because case mismatch.

Answer

An empty string because no match.

Question 6

Refer to the exhibit. An automatic lookup is configured with WILDCARD match type. What kind of matching does this enable?

Accepted Answer

Matching based on prefixes or suffixes using wildcards.. An automatic lookup configured with WILDCARD match type enables matching based on prefixes or suffixes using wildcards. This allows the lookup to match field values that contain a wildcard character (e.g., * or ?) to represent variable parts of the string, enabling flexible pattern matching beyond exact equality.

Answer

Exact match only.

Answer

Case-insensitive match.

Answer

Matching only on the first N characters.

Question 7

A security analyst wants to count the number of unique users who have logged in over the past week. Which field-based command should they use?

Accepted Answer

index=main sourcetype=login | dedup user | stats count. It first uses `dedup user` to remove duplicate user values, leaving only unique users, and then `stats count` to count the remaining events, which effectively counts the number of unique users who logged in over the past week. This approach ensures each user is counted only once, meeting the requirement for a unique count.

Answer

index=main sourcetype=login | stats sum(user)

Answer

index=main sourcetype=login | stats count by user

Answer

index=main sourcetype=login | top user

Question 8

A Splunk administrator receives a complaint that a saved search is slow. The search uses a lookup to enrich events with a CSV file that has 500,000 rows. Which optimization is most effective?

Accepted Answer

Filter events early using eval or where before applying the lookup.. Filtering events early with `eval` or `where` reduces the volume of data that must be processed by the lookup command. Since lookups perform a row-by-row match against a 500,000-row CSV, minimizing the number of events before the lookup drastically cuts I/O and CPU overhead, making the search faster.

Answer

Sort events by the lookup key field before the lookup command.

Answer

Convert the CSV lookup to a KV store lookup for faster access.

Answer

Increase the search time range to process more events at once.

Question 9

A Splunk admin notices that a lookup is not matching fields correctly. The lookup file has a header row with field names. The search uses `lookup usernames.csv user_id OUTPUT username`. Some events have `user_id` values that exist in the lookup but no match occurs. What is the most likely cause?

Accepted Answer

The lookup file has leading or trailing spaces in the matching column.. Leading or trailing spaces in the lookup file's matching column prevent exact string matching. When Splunk performs a lookup, it compares the field value from the event with the lookup file value using an exact string match. If the lookup file contains spaces (e.g., '123 ' instead of '123'), the values will not match even though the event's `user_id` appears correct. This is a common data quality issue in CSV files.

Answer

The lookup file is missing the header row.

Answer

The lookup is case-sensitive and the search field has different case.

Answer

The lookup file has quotes around field values that are not stripped.

Question 10

Refer to the exhibit. An analyst runs the search and expects the `country`, `region`, and `city` fields to appear in the results, but they do not. What is the most likely reason?

Accepted Answer

The lookup file is not defined as a lookup in Splunk's lookups definitions.. Splunk requires a lookup file to be explicitly defined in Settings > Lookups > Lookup definitions before it can be used in a search. Without this definition, the `lookup` command will not find the file, and no fields will be added to the results, even if the file exists on disk.

Answer

The fields in the lookup must have different names than the output fields.

Answer

The clientip field in the events has a different data type than the lookup.

Answer

The lookup command should use OUTPUTNEW instead of OUTPUT.

Question 11

Refer to the exhibit. The search returns a count for only a subset of user_ids, even though all user_ids exist in the lookup. What could explain this?

Accepted Answer

The events that are missing have different user_id representations (e.g., leading/trailing spaces) causing lookup failure, so first_name is null and they are filtered out.. The lookup command matches user_id values exactly. If some events have user_id values with leading/trailing spaces or other subtle differences (e.g., case sensitivity), the lookup fails to match those events, resulting in null first_name values. The subsequent `stats count by first_name` then filters out those null values, so only the subset of user_ids that successfully matched appear in the results.

Answer

The stats command is grouping by user_id, which combines multiple events into one count per user.

Answer

The lookup definition must also include the OUTPUT fields in the definition for them to be used.

Answer

The lookup definition has max_matches=1, but some user_ids have multiple matches in the lookup file.

Question 12

A user wants to create a lookup table to enrich events with customer information. Which file format is NOT supported for a classic CSV-based lookup?

Accepted Answer

XLSX. Classic CSV-based lookups in Splunk only support delimited text files such as CSV (comma-separated) and TSV (tab-separated). XLSX is a binary Excel format that is not supported for classic CSV-based lookups; it requires a different lookup type (e.g., a KV store lookup or a scripted lookup) or must be converted to CSV first. JSON is also not supported for classic CSV-based lookups; it requires a KV store lookup or a scripted lookup. Therefore, both B (XLSX) and D (JSON) are NOT supported formats.

Answer

TSV

Answer

CSV

Question 13

An analyst runs `| inputlookup mylookup.csv` but gets no results. The lookup file exists. What is the most likely cause?

Accepted Answer

The file is not in the correct lookup directory.. The `| inputlookup` command reads lookup files only from the lookups directory within the current app or from the system-level lookups directory. If the file exists elsewhere on the filesystem (e.g., in a custom path or the user's home directory), the command will return no results. This is the most likely cause because the error is not about the file's existence but about its location relative to Splunk's expected lookup paths.

Answer

The search time range is too narrow.

Answer

The lookup command requires an output fields.

Answer

The file is not sorted.

Question 14

A lookup definition is configured with a very large CSV file. The lookup performs slowly. Which change would most improve performance?

Accepted Answer

Ensure the lookup field in the file is the first column.. Splunk's lookup command performs a linear scan of the CSV file to find matching values. By placing the lookup field as the first column, Splunk can use an internal optimization that reduces the search space, as it can quickly locate the matching row without scanning the entire file. This is the most effective single change for improving performance with a large CSV-based lookup.

Answer

Use inputlookup instead of lookup.

Answer

Add an index to the lookup file.

Answer

Convert the CSV to a TSV.

Question 15

A user runs a search and uses `| lookup mylookup myfield OUTPUT myfield2`. The search returns events that have myfield values, but myfield2 is null. The lookup file has matching entries. What is the most likely issue?

Accepted Answer

The lookup definition is case-sensitive and the event values have different case.. The lookup definition in Splunk has a case-sensitivity setting. By default, lookups are case-insensitive, but if the lookup definition is configured to be case-sensitive, then the lookup will only match when the case of the event field value exactly matches the case in the lookup file. Since the events have myfield values but myfield2 is null, the lookup is failing to match due to case differences, even though the lookup file has matching entries.

Answer

The lookup definition is missing the max_matches setting.

Answer

The lookup file has duplicate keys.

Answer

The lookup command should use OUTPUTNEW instead of OUTPUT.