SPLK-1001 Using Fields and Lookups Practice Test 3 — 15 Questions

Question 1

You are a Splunk admin for a large enterprise with multiple distributed Splunk components. The security team frequently runs searches that use a large CSV lookup file (500MB) containing threat intelligence indicators. They report that searches are slow and sometimes time out. The lookup file is updated hourly via an automated script. The team currently uses the 'lookup' command in every search. You need to improve performance without sacrificing data freshness. Your environment has a search head cluster and indexer cluster. The lookup file is stored on a shared filesystem accessible to all search heads. Which single approach will best improve search performance while maintaining hourly updates?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the lookup as a time-based lookup with a filter condition to only apply to events with matching IP fields, and use automatic lookup to avoid manual command.. Configuring the lookup as a time-based lookup with a filter condition reduces the number of events that need to be matched against the 500MB CSV, and using an automatic lookup eliminates the need for the manual 'lookup' command in every search. This approach improves performance by limiting the lookup scope to relevant events (e.g., only those with matching IP fields) while still allowing the hourly script to update the CSV file, maintaining data freshness.

Answer

Increase the search concurrency limit on the search head to allow more parallel lookups.

Answer

Convert the CSV to a KV Store collection and use the 'lookup' command with the KV Store lookup.

Answer

Move the CSV file to each indexer and use index-time field lookup.

Question 2

An administrator needs to extract a field from log data where the value appears between two square brackets, for example [error_code: 404]. Which search command should they use to create a custom field extraction without modifying the original data?

Accepted Answer

rex. The `rex` command is used to extract fields using regular expressions without modifying the raw event data. In this scenario, `rex` can parse the pattern `$$error_code: (?<field>\d+)$$` to capture the value between square brackets into a new field, leaving the original log intact.

Answer

eval

Answer

fields

Answer

extract

Question 3

A security analyst wants to enrich authentication logs with a lookup table containing user department and manager information. Which TWO statements are true about using lookups in Splunk?

Accepted Answer

The inputlookup command can be used to load a lookup file into a search.. The `inputlookup` command loads the contents of a static lookup file (e.g., CSV, KV store) directly into a search pipeline as events, allowing the analyst to inspect or further process the lookup data. This is a standard Splunk SPL command used for ad-hoc enrichment without requiring a defined lookup definition.

Answer

Once a lookup is defined, it cannot be updated.

Answer

Lookups can only be created from CSV files.

Answer

Lookups can only match on a single field.

Question 4

A Splunk administrator configured an automatic lookup as shown. When searching index=main source=/var/log/auth.log, the department field is not populated. What is the most likely cause?

Accepted Answer

The match_type syntax is incorrect and the field mapping is mismatched.. The most common cause for a lookup not populating a field is a mismatch between the field mapping in the transforms.conf stanza and the actual field names in the lookup table. If the match_type syntax is incorrect (e.g., using WILDCARD instead of EXACT or specifying the wrong field name), Splunk will fail to match events to lookup entries, leaving the department field empty.

Answer

The LOOKUP- stanza requires a numeric priority.

Answer

The transforms.conf file is not in the correct directory.

Answer

The user_lookup.csv file does not exist in the lookups directory.

Question 5

Which three of the following are valid methods for creating or using field extractions in Splunk? (Choose three.)

Accepted Answer

Using the Field Extractor (FX) interactive tool to generate regex-based extractions. The Field Extractor (FX) interactive tool is a valid method because it provides a GUI to generate regex-based extractions by highlighting sample data. Manually writing regular expressions in `props.conf` and `transforms.conf` is the standard way to define custom field extractions at the index-time or search-time level. The `| extract` command is valid because it performs key-value pair extraction on search results, typically for data formatted as `key=value` pairs, without requiring configuration files.

Answer

Using the `| fields` command to extract new fields from raw data

Answer

Configuring automatic field extraction via the `fieldaliases.conf` file

Answer

Using the `| rename` command to create new fields by renaming existing ones

Question 6

Which three of the following statements about lookup tables and their usage in Splunk are correct? (Choose three.)

Accepted Answer

A lookup table can be defined as a CSV file stored in the lookups directory of an app. The first three statements are correct. Lookup tables can be defined as CSV files stored in the lookups directory of an app, which is a standard method for creating static lookups. The `| inputlookup` command retrieves and returns the contents of a lookup table as search results, allowing you to inspect or use the data. Lookups can be configured to automatically enrich events during search time using the `lookup` command, which matches fields in events against the lookup table to add additional fields.

Answer

Lookup table files must always have a .csv extension and cannot be in other formats like .kvstore

Answer

The `| outputlookup` command is used to append data to an existing lookup file without any limitations

Answer

Lookups can only match on a single field; using multiple fields requires creating separate lookups

Question 7

Which of the following are true statements about using fields and lookups in Splunk? Choose all that apply. (There are four correct answers.)

Accepted Answer

The `| inputlookup` command is used to load the entire contents of a lookup file into search results, allowing you to inspect or aggregate on the lookup data directly.. The first option is correct because lookup tables in Splunk allow you to add fields to events by matching a field in the event with a field in the lookup file, enriching the data. The second option is correct because the `| lookup` command supports both CSV files and KV store collections, enabling flexible data enrichment. The fourth option is correct because geospatial lookups require latitude and longitude coordinates and are used with the `| geom` command for map visualizations. The fifth option is correct because `| inputlookup` loads the entire lookup file into search results, allowing direct inspection or aggregation of lookup data.

Answer

Extracted fields using the `| rex` command are automatically added to the field sidebar and can be used in searches without any additional configuration.

Answer

Field aliases defined in props.conf can rename a field in search results without altering the raw data, but they are not applied retroactively to events indexed in the past.

Question 8

Drag and drop the steps to create a simple Splunk search that returns results for a specific error in the last 24 hours into the correct order.

Accepted Answer

Select the Search & Reporting app, Enter the search query for the error, Set the time range to Last 24 hours, Run the search.. Basic search workflow involves selecting the app, entering the search with time range, executing, and reviewing results.

Answer

Set the time range to Last 24 hours, Select the Search & Reporting app, Enter the search query for the error, Run the search.

Answer

Enter the search query for the error, Select the Search & Reporting app, Set the time range to Last 24 hours, Run the search.

Answer

Select the Search & Reporting app, Set the time range to Last 24 hours, Run the search, Enter the search query for the error.

Question 9

Drag and drop the steps to configure Splunk to use LDAP authentication into the correct order.

Accepted Answer

Select LDAP as authentication method, then configure LDAP server settings, then map LDAP groups to Splunk roles, then test the LDAP configuration.. LDAP setup involves selecting the method, configuring server details, mapping groups, and testing.

Answer

Map LDAP groups to Splunk roles, then configure LDAP server settings, then select LDAP as authentication method, then test the LDAP configuration.

Answer

Test the LDAP configuration, then select LDAP as authentication method, then configure LDAP server settings, then map LDAP groups to Splunk roles.

Answer

Select LDAP as authentication method, then test the LDAP configuration, then configure LDAP server settings, then map LDAP groups to Splunk roles.

Question 10

Match each knowledge object to its definition.

Accepted Answer

Event: A single record of data that represents an occurrence in a system. The correct matches are: Event (single record), Index (data repository), Report (saved search/visualization), Alert (scheduled search with actions), Field (extracted name-value pair). Common confusions include swapping Index with Report or Event with Indexer Cluster.

Answer

Event: A collection of indexers that process and store data

Answer

Index: A saved search that generates a list of events that satisfy certain criteria

Answer

Report: A field extraction that automatically identifies key-value pairs in raw data

Answer

Alert: A dashboard panel that displays real-time data from a saved search

Answer

Field: A collection of events grouped by a common timestamp or source

Question 11

Match each search mode to its behavior.

Accepted Answer

Fast mode: Returns only fields referenced in the search, improving performance.. Splunk search modes: Fast returns only search-referenced fields; Smart dynamically selects fields; Verbose returns all fields. Confusing these leads to incorrect expectations about performance and output.

Answer

Fast mode: Returns all fields for each event.

Answer

Verbose mode: Returns only fields referenced in the search.

Question 12

A user wants to rename the field 'src_ip' to 'sourceIP' in all search results without modifying the raw data. Which method should they use?

Accepted Answer

Use the rename command: | rename src_ip as sourceIP. The `rename` command is the correct choice because it changes the field name in the search results without altering the underlying raw data. It operates on the field metadata in the search pipeline, allowing you to display 'sourceIP' instead of 'src_ip' for the duration of the search.

Answer

Use the eval command to assign src_ip to a new field sourceIP

Answer

Add an alias in props.conf

Answer

Use the fields command: | fields src_ip as sourceIP

Question 13

A security team needs to enrich their authentication events with risk scores from a CSV file that maps username to risk_score. The CSV is updated daily and has 100,000 rows. Which lookup configuration is most appropriate?

Accepted Answer

Configure a CSV lookup and use lookup command in search. A CSV lookup is the simplest and most efficient way to enrich events with static data from a file that is updated daily. The `lookup` command can be used in search to match the username field from events to the username column in the CSV and add the risk_score field. For 100,000 rows, a CSV lookup is appropriate as it is loaded into memory and can be refreshed by replacing the file, without needing complex infrastructure.

Answer

Use a time-based lookup to match event time with lookup time

Answer

Set up an external lookup that calls a REST API

Answer

Create a KV Store lookup and update it via REST

Question 14

A team has a lookup table 'app_errors.csv' that includes a field 'error_code'. They want to automatically join error descriptions from 'error_codes.csv' on 'error_code' every time they search a sourcetype. What is the best way to achieve this?

Accepted Answer

Set up an automatic lookup in props.conf for the sourcetype. An automatic lookup in props.conf allows you to define a lookup that runs automatically on every search for a given sourcetype, without requiring manual invocation. This configuration joins the 'error_code' field from the search results with the 'error_codes.csv' lookup table, appending the description field to every event of that sourcetype. It is the most efficient and consistent method for automatically enriching data at search time.

Answer

Use an eval statement with if() to assign description

Answer

Configure field aliases to rename 'error_code'

Answer

Use the lookup command in every search

Question 15

An organization uses a KV Store lookup to maintain a list of known malicious IPs. The lookup is updated every 5 minutes via a script. Analysts complain that their searches sometimes miss recent additions. What is the most likely cause?

Accepted Answer

The KV Store lookup is cached and not refreshed between searches. The most likely cause is that the KV Store lookup is cached. By default, KV Store lookups are cached per search and only refreshed when the cache expires or at the start of a new search. If analysts run searches within the same cache duration, they may miss recent updates. Option A is not applicable because KV Store lookups are not time-based in the same way as time-based lookups. Option B is incorrect because IP addresses are not case-sensitive; lookup matching is case-insensitive by default. Option C is incorrect because the _raw field is unrelated to lookup functionality. Therefore, the correct answer is D.

Answer

The lookup is configured as time-based and is out of range

Answer

The IP addresses are case-sensitive and messy

Answer

The search does not include the _raw field