SPLK-1001 Using Fields and Lookups Practice Test 4 — 15 Questions

Question 1

A user has a search that produces a chart of error counts by host. They want to add a calculated field 'error_rate' as errors per million events. Which approach is correct?

Accepted Answer

Use eventstats to get total counts, then eval to compute rate, then chart. It uses `eventstats` to compute the total count of events per host across the entire result set, then `eval` to calculate the error rate as (error_count / total_count) * 1,000,000, and finally `chart` to display the results. This two-step approach ensures the total count is available for each row before the rate calculation, which is necessary because `chart` alone cannot reference a field computed in the same command.

Answer

Use chart eval(error_count/total_count) by host

Answer

Use stats to compute error_rate directly: stats avg(error_rate) by host

Answer

Use the lookup command to apply a calculated field

Question 2

A user wants to see the list of all fields that are extracted from a specific sourcetype. Which command should they use?

Accepted Answer

| fieldsummary. The `fieldsummary` command provides a summary of all fields extracted from the events in the search results, including their count, distinct count, and percentage of events containing each field. When applied to a specific sourcetype, it lists every field that has been extracted from that sourcetype, making it the correct tool for this task.

Answer

| rex field=_raw ...

Answer

| fields *

Answer

| eval fields=...

Question 3

Your team uses a large CSV lookup 'users.csv' with 200,000 rows. When running searches that use this lookup via the lookup command, performance is slow. Which action would most improve performance?

Accepted Answer

Add an index to the lookup file by converting to KV Store. To improve performance with a large CSV lookup (200,000 rows), converting it to a KV Store (Option C) is the best choice because KV Store lookups are indexed, making field matching much faster than searching the entire CSV file each time. Option A (external lookup) is wrong because querying a database adds network and database overhead, often slowing performance further. Option B (increasing timeout) does not speed up the lookup; it only prevents timeouts during long operations. Option D (increasing max_matches) controls how many matching results are returned, but does not affect the speed of the lookup operation itself.

Answer

Switch to an external lookup that queries a database

Answer

Increase the lookup timeout value

Answer

Increase the max_matches setting for the lookup

Question 4

An administrator notices that an automatic lookup is not being applied to events from a certain sourcetype. The lookup file exists and the configuration in props.conf appears correct. What is a possible reason?

Accepted Answer

The lookup table is defined in transforms.conf incorrectly. The automatic lookup is defined in props.conf, but the actual lookup table configuration (including the lookup file name, field mappings, and match type) is specified in transforms.conf. If transforms.conf is missing, has a syntax error, or incorrectly defines the lookup (e.g., wrong filename, mismatched field names, or incorrect stanza name), the automatic lookup will fail silently, even if props.conf appears correct.

Answer

Splunk needs to be restarted after adding the automatic lookup

Answer

The lookup file is stored in the wrong directory but referenced correctly

Answer

The lookup field is case-sensitive and the data doesn't match

Question 5

Which TWO of the following are valid ways to create a field alias in Splunk?

Accepted Answer

Use the INDEXED_EXTRACTIONS setting with an alias directive. The INDEXED_EXTRACTIONS setting in props.conf can include an alias directive (e.g., `alias::=`) to define field aliases directly at index time. This allows you to map an extracted field to an alternative name without modifying the raw data or using search-time operations.

Answer

Use eval to assign a field to another field name

Answer

Use the rename command in a saved search

Answer

Use the aliases command in a search

Question 6

Which TWO of the following are true about KV Store lookups in Splunk?

Accepted Answer

KV Store lookups can be used in automatic lookups. KV Store lookups can be configured as automatic lookups in Splunk, meaning they can be applied at search time without requiring an explicit lookup command. This is done by defining the KV Store collection as a lookup in transforms.conf and then associating it with a source type or host in props.conf, just like CSV or external lookups.

Answer

KV Store lookups automatically support time-based retrieval

Answer

KV Store lookups are stored as CSV files on the search head

Answer

KV Store lookups only support exact match lookups

Question 7

Which THREE of the following are valid options for the lookup command?

Accepted Answer

local=. The `local=` parameter in the lookup command specifies whether the lookup should be performed on the search head (local) or distributed across indexers. When set to `true`, the lookup file is read from the search head; when `false`, it is distributed to all indexers, which is critical for performance in large environments.

Answer

rename <field> as <alias>

Answer

join <field>

Question 8

Refer to the exhibit. The search returns no results from the lookup. What is the most likely issue?

Accepted Answer

The lookup command references 'error_id' but the alias changed the field to 'error_code'. The search uses `lookup error_codes.csv error_id` but the FIELDALIAS in props.conf has renamed the field `error_id` to `error_code`. Since the lookup command references the original field name `error_id`, which no longer exists in the events after alias processing, the lookup cannot match any values and returns no results.

Answer

The FIELDALIAS syntax is incorrect

Answer

The lookup table is not defined in transforms.conf

Answer

The lookup file 'error_codes.csv' does not exist

Question 9

Refer to the exhibit. The search results show city and country fields from the GeoIP lookup. What does the automatic lookup use as the input field to match against the lookup table?

Accepted Answer

ip. The automatic GeoIP lookup in Splunk uses the `ip` field as the default input field to match against the lookup table. This is because the GeoIP lookup is designed to map IP addresses to geographic locations, and the lookup table expects an IP address as the key. When you configure an automatic lookup, you specify the input field (e.g., `ip`) that corresponds to the lookup table's key field, allowing Splunk to enrich events with location data.

Answer

All fields in the event

Answer

No input field, it directly appends all lookup fields

Answer

clientip

Question 10

Refer to the exhibit. What would happen if the eval statement was changed to: eval priority = case(error = "critical", 1, error = "warning", 2, true(), 3)?

Accepted Answer

All events are assigned priority 1. Using assignment `=` instead of comparison `==` in the `case` function causes each condition to evaluate as an assignment. In Splunk eval, assignment returns the assigned value, which is truthy for non-empty strings. The first condition `error = "critical"` is always true, so the first branch is taken for every event, setting `priority=1`. Consequently, the search returns results where every event has priority 1, which differs from the original output where priorities varied. No syntax error occurs.

Answer

The search returns no results

Answer

The search only returns priority 3

Answer

The search returns a syntax error

Question 11

A search using `| lookup user_lookup user_id OUTPUT department_name` returns incorrect department names for some users. The lookup file is correct. What could be the issue?

Accepted Answer

The field `user_id` in the events has trailing spaces.. Trailing spaces in the `user_id` field within the events will cause the lookup to fail to match the corresponding entry in the lookup file, even though the lookup file itself is correct. Splunk performs exact string matching for lookups by default, so any leading or trailing whitespace in the event data will prevent a match, leading to incorrect or missing output. Using the `trim` function or a `| rex` command to strip whitespace before the lookup resolves this issue.

Answer

The output field name is misspelled in the search.

Answer

The lookup file has duplicate entries for the same user_id.

Answer

The lookup definition uses case-insensitive matching.

Question 12

Which command is used to import an external CSV file into a Splunk lookup table for the first time?

Accepted Answer

`| outputlookup`. The `| outputlookup` command is used to create or overwrite a lookup table file in Splunk from search results. When importing an external CSV file into a Splunk lookup table for the first time, you would first ingest the CSV data (e.g., via `| inputcsv` or by uploading the file), then use `| outputlookup` to write that data into a lookup definition that Splunk can reference.

Answer

`| lookup`

Answer

`| inputlookup`

Answer

`| fields`

Question 13

A user wants to see the values of all fields in an event, including fields that are not automatically extracted. Which search command should be used?

Accepted Answer

`| table *`. The `| table *` command displays all fields in each event, including those not automatically extracted, by listing every field in a tabular format. This is because the asterisk wildcard in `table` includes all fields present in the search results, regardless of whether they are extracted by default or through custom parsing. In contrast, `| fields *` only retains fields that are already known to the search index, not necessarily showing all raw event data.

Answer

`| rex`

Answer

`| fields *`

Answer

`| spath`

Question 14

A lookup table has been defined with `max_matches = 5`. What does this setting do?

Accepted Answer

It limits the lookup to return at most 5 results per event.. The `max_matches` parameter in a Splunk lookup definition controls how many matching rows from the lookup table are appended to a single event. When set to 5, Splunk will return at most 5 lookup results for each event that matches the lookup criteria, preventing excessive field duplication.

Answer

It limits the number of fields output from the lookup.

Answer

It creates a maximum of 5 lookup files.

Answer

It limits the lookup to match only 5 events.

Question 15

Which of the following is a default field that is automatically extracted by Splunk?

Accepted Answer

`host`. The `host` field is a default field that Splunk automatically extracts from every event, typically derived from the hostname of the machine that generated the data. It is one of the three default fields (along with `source` and `sourcetype`) that Splunk uses to categorize and search events, and it is always available without any custom field extraction or configuration.

Answer

`department`

Answer

`error_code`

Answer

`user_id`