SPLK-1001 Using Fields and Lookups Practice Test 4 — 15 Questions

Question 1

An analyst wants to automatically look up a field 'user_id' in a lookup file every time a search is run, without having to type the lookup command manually. Which approach is best?

Accepted Answer

Configure a lookup definition and set it as a default lookup for the index.. Automatic lookups are configured under Settings > Lookups > Automatic lookups. You define a lookup definition and then apply it to a specific source type or index, which causes the lookup to run automatically on every search matching that source type or index without requiring the manual `lookup` command. This is the intended method for automatic lookups in Splunk.

Answer

Add the lookup to the search command.

Answer

Create a regex extraction for user_id.

Answer

Use an alias to rename the field.

Question 2

Which THREE of the following are capabilities of the rex command?

Accepted Answer

Extract fields using regex named groups.. Option B is correct because the rex command extracts new fields by matching regular expressions that contain named capture groups, e.g. rex field=_raw "(?<user>\w+)", creating a field named after each group. Option C is correct because rex supports a mode=sed argument that applies sed-style substitution expressions to replace or transform text in a field, e.g. rex mode=sed "s/foo/bar/g". Option E is correct because rex accepts a field parameter (defaulting to _raw) that specifies which existing field the regular expression is applied to, allowing extraction from any field rather than only the raw event. Option A is not a rex capability since rex regex matching is case-sensitive by default and requires explicit inline flags such as (?i) for case-insensitive matching. Option D is not a rex capability because setting default values for fields is done with other commands such as eval (e.g. eval field=coalesce(field, "default")) or fillnull, not rex.

Answer

Perform case-insensitive extraction by default.

Answer

Set a default value for a field.

Question 3

Refer to the exhibit. An analyst runs a search that uses this lookup. The lookup returns multiple matches for some events. Which of the following is true?

Accepted Answer

Only the first 5 matching rows are returned.. By default, Splunk's lookup command returns only the first matching row from the lookup table when multiple matches exist for a single event. This behavior is controlled by the `max_matches` parameter, which defaults to 1, but the question states that the first 5 matching rows are returned, indicating that the `max_matches` setting has been explicitly configured to 5. The lookup command does not automatically return all matches or require a sorted lookup file for this behavior.

Answer

The default value 'UNKNOWN' is used when there is no match.

Answer

All matching rows are returned for each event.

Answer

The lookup file must be sorted.

Question 4

A user creates a CSV lookup file 'users.csv' with columns 'userid' and 'full_name'. A lookup definition is set up. The search `index=auth | lookup users.csv userid AS user OUTPUT full_name` returns no results for 'full_name' even though there are matching userids. What is the most likely cause?

Accepted Answer

The lookup name 'users.csv' should be the lookup definition name, not the filename.. The `lookup` command in Splunk requires the lookup definition name, not the filename, when referencing a lookup table. Even though the CSV file is named 'users.csv', the lookup definition created in Settings > Lookups defines the logical name used in searches. Using the filename directly causes Splunk to fail to resolve the lookup, resulting in no 'full_name' values being returned.

Answer

The search returns no events for the userid field.

Answer

The lookup command should be placed before the index search.

Answer

The 'AS user' should be 'AS userid'.

Question 5

A Splunk admin has a lookup with 10 million rows. The search uses this lookup as a left join and takes too long. Which design change would most improve performance?

Accepted Answer

Filter the main search to only relevant events before the lookup.. Filtering the main search to only relevant events before the lookup reduces the number of rows that need to be matched against the 10-million-row lookup table. This minimizes the computational overhead of the left join operation, as Splunk must compare each event from the main search against every row in the lookup. By narrowing the event set early, you drastically cut the number of comparisons, directly improving search performance.

Answer

Use the 'output' clause to limit returned fields.

Answer

Use an automatic lookup instead of the lookup command.

Answer

Convert the lookup to a KV store collection.

Question 6

An organization needs to enrich authentication events with employee department information stored in a MySQL database. The data is updated frequently. Which lookup type is most appropriate?

Accepted Answer

External lookup. An external lookup is the most appropriate choice for enriching authentication events with data from a MySQL database that is updated frequently. External lookups can execute a script or command (e.g., Python, Perl) that queries the database on every search, or they can be used with Splunk DB Connect to directly connect to MySQL and retrieve fresh data. Unlike KV Store lookups, which rely on manually populating Splunk's internal store and do not natively connect to external databases, external lookups provide real-time access to the live database. CSV lookups are static and require manual reloading, and geographic lookups are for geospatial data only.

Answer

Geographic lookup

Answer

CSV file lookup

Answer

KV store lookup

Question 7

A time-based lookup is configured with `max_offset_secs = 3600`. An event has a timestamp 100 seconds after the lookup time value. Will the lookup match?

Accepted Answer

Yes, because the offset is within the allowed range.. The time-based lookup is configured with `max_offset_secs = 3600`, which defines the maximum allowed offset (in seconds) between the event timestamp and the lookup time. Since the event timestamp is 100 seconds after the lookup time, the offset is 100 seconds, which is well within the 3600-second window. No `min_offset_secs` is required for this match to succeed, as the default minimum offset is 0 (meaning the event timestamp can be equal to or later than the lookup time).

Answer

Yes, but only if min_offset_secs is also set.

Answer

No, because the event timestamp is later than the lookup time.

Answer

No, because the event timestamp must be before the lookup time.

Question 8

A search needs to replace a field value 'user' with 'full name' using a CSV lookup that has 'username' and 'fullname' columns. Which lookup command is correct?

Accepted Answer

| lookup users.csv username AS user OUTPUT fullname AS full_name. The `lookup` command syntax requires specifying the lookup file, then the field name in the lookup file (`username`) mapped to the field in the event (`user`) using `AS`, and then `OUTPUT` to bring the `fullname` field into the event as a new field named `full_name`. This matches the requirement to replace the field value 'user' with 'full name' by using the CSV lookup's `fullname` column.

Answer

| lookup users.csv username AS user OUTPUTNEW fullname

Answer

| lookup users.csv user AS username OUTPUT fullname

Answer

| lookup users.csv user AS fullname OUTPUT username

Question 9

When using an automatic lookup in props.conf, which setting controls the order in which multiple automatic lookups apply to the same sourcetype?

Accepted Answer

The numeric suffix after LOOKUP- in props.conf. In Splunk, when multiple automatic lookups are defined for the same sourcetype in props.conf, the order of execution is determined by the numeric suffix appended to the LOOKUP- stanza (e.g., LOOKUP-1, LOOKUP-2). Splunk processes these lookups in ascending numeric order, ensuring a predictable sequence. This allows administrators to chain lookups where the output of one lookup can feed into the next.

Answer

The order in which they are listed in transforms.conf

Answer

The `batch_index_query` setting

Answer

The `priority` field in the lookup definition

Question 10

Which TWO of the following are best practices for managing lookup files in Splunk?

Accepted Answer

Store the lookup file in $SPLUNK_HOME/etc/system/lookups or an app's lookups directory.. Option B is correct because Splunk's documented best practice is to store lookup files in the appropriate lookups directory, either $SPLUNK_HOME/etc/system/lookups for system-wide use or $SPLUNK_HOME/etc/apps/<app_name>/lookups for app-scoped use, which ensures proper replication and permission handling. Option E is correct because CSV lookup files must include a header row so Splunk can map field names to lookup columns; without a header, the lookup definition cannot reference fields correctly. Option A is wrong because $SPLUNK_HOME/var/run is a runtime directory for process state (such as PID files), not a supported location for lookup definitions, and files there may be cleared on restart. Option C is wrong as a blanket best practice because global lookups (defined in system/local) are shared across all apps and can cause naming conflicts or unintended data exposure; app-scoped lookups are preferred unless cross-app sharing is truly required. Option D is wrong because Splunk expects Unix-style LF line endings for CSV lookups; CRLF can introduce stray carriage-return characters into the last field of each row.

Answer

Place lookup files in $SPLUNK_HOME/var/run to avoid permission issues.

Answer

Use global lookups to share across all apps.

Answer

Use Windows-style CRLF line endings for cross-platform compatibility.

Question 11

Which TWO of the following commands can be used to view the current fields in a search result?

Accepted Answer

| fields. The `| fields` command is used to keep or remove specific fields from search results, effectively showing you the current fields that exist in the result set. The `| fieldsummary` command produces a statistical summary of all fields present in the search results, including count, distinct count, and other metrics, thereby also allowing you to view the current fields.

Answer

| outputlookup mylookup.csv

Answer

| inputlookup mylookup.csv

Answer

| listfields

Question 12

Which THREE of the following are true about automatic field extraction in Splunk?

Accepted Answer

It can extract fields from structured data like JSON and XML.. Option A is correct because Splunk's automatic field extraction handles structured formats such as JSON and XML, using the structured data itself (keys/elements) to derive fields like nested key-value pairs without manual regex. Option C is correct because automatic extraction applies default patterns and built-in knowledge objects (e.g., for common sourcetypes and formats) to raw event data to identify fields such as host, source, sourcetype, and common key=value pairs. Option D is correct because automatically extracted fields are indexed/search-time fields that become immediately available for searching and use in SPL as soon as the data is searchable, without requiring additional configuration. Option B is incorrect because custom field extractions (regex-based, delimiter-based, or via transforms.conf/props.conf) can coexist with automatic extraction and are commonly added to supplement it. Option E is incorrect because automatic field extraction can be controlled or disabled for specific sourcetypes, for example by setting KV_MODE = none or AUTO_KV_JSON = false in props.conf.

Answer

Custom field extractions are not allowed if auto extraction is enabled.

Answer

Auto extraction cannot be disabled for specific sourcetypes.

Question 13

A security analyst needs to enrich firewall logs with user identity information stored in a CSV file. The CSV file contains fields: user_id, username, department, location. The firewall logs contain a field 'src_user_id'. Which Splunk feature should be used to add the username and department fields to the firewall events based on matching src_user_id to user_id?

Accepted Answer

Define a lookup table from the CSV file and use the input lookup command or automatic lookup to add username and department. A lookup table defined from the CSV file allows Splunk to map the 'src_user_id' field in firewall events to the 'user_id' field in the CSV, then add the 'username' and 'department' fields from the lookup. This is the standard method for enriching events with external data using the 'inputlookup' command or an automatic lookup configuration.

Answer

Create a field alias that maps src_user_id to username and department

Answer

Use the eval command with an if statement to populate username and department from src_user_id

Answer

Create a calculated field that computes username and department based on src_user_id

Question 14

A Splunk administrator notices that a lookup definition named 'assets' is not returning any results in searches even though the CSV file exists and has data. The lookup definition uses the filename 'assets.csv' and the matching field 'ip' matches the event field 'dest_ip'. The search query 'index=main | lookup assets ip AS dest_ip OUTPUT asset_name' returns no asset_name values. What is the most likely cause?

Accepted Answer

The user may not have permissions to access the lookup definition; check the knowledge object permissions. The lookup definition exists and the CSV file has data, but the search returns no results, indicating a permissions issue. In Splunk, knowledge objects like lookups have permissions that restrict which roles can use them; if the user's role lacks read access to the 'assets' lookup definition, the lookup command will silently return no results. The syntax and command structure are otherwise correct, so the most likely cause is that the lookup definition's permissions are not set to allow the user's role.

Answer

The lookup command syntax is incorrect; it should be 'lookup assets dest_ip AS ip'

Answer

The lookup command is missing the 'name' field; it should be 'lookup assets name AS ip'

Answer

The command should use 'inputlookup' instead of 'lookup' to load the CSV data

Question 15

A Splunk user wants to create a lookup that maps a field 'status_code' to a human-readable 'status_description'. The lookup data is small and changes infrequently. Which TWO methods are appropriate for creating this lookup? (Choose two.)

Accepted Answer

Create a lookup definition file (transforms.conf) with the mapping inline. Option E is correct because the standard way to build a small, static field-to-description mapping in Splunk is to save a CSV file containing the status_code and status_description columns and then define a lookup (via the lookup definition in transforms.conf referencing that CSV), which is exactly suited to small, infrequently changing data. Option A is correct because a lookup definition in transforms.conf can embed the mapping inline using the 'filename' or an inline stanza, allowing Splunk to resolve the status_code to status_description without an external file, which is appropriate for a small, rarely modified mapping. Option B is not appropriate because KV Store collections are designed for larger, frequently updated, or app-managed datasets and add unnecessary complexity for a static mapping. Option C is wrong because the 'lookup' command only invokes an existing lookup during a search; it does not create a persistent mapping. Option D is wrong because calculated fields in props.conf derive values from event fields at search time and cannot perform a code-to-description table lookup.

Answer

Create a KV Store collection to store the mapping

Answer

Use the 'lookup' command in a search to create a temporary mapping each time

Answer

Use a calculated field in props.conf to derive the description from the code