SPLK-1001 Using Fields and Lookups Practice Test 5 — 15 Questions

Question 1

A Splunk administrator is troubleshooting a time-based lookup that is supposed to match events to a lookup table that changes over time. The lookup is defined with time_field 'start_time' and time_format '%Y-%m-%d %H:%M:%S'. Which THREE conditions must be met for the time-based lookup to correctly match an event to a single row in the lookup table? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The lookup definition must specify the time format used in the time_field column. Option C is correct because a time-based lookup requires the lookup definition (transforms.conf) to declare the time_field and a matching time_format so Splunk can parse the start_time column into an epoch value for comparison. Option D is correct because the core matching logic of a time-based lookup is that the event's timestamp (or the field named by time_field in the event) must fall within the row's start_time-to-end_time window for that row to apply. Option E is correct because Splunk requires that an event match at most one row for the given time range; if multiple rows overlap the event's time, the lookup cannot resolve a single value and the match fails or is ambiguous. Option A is not required, since a time-based lookup is built around start_time/end_time ranges and multiple rows can share or overlap time values as long as only one matches a given event. Option B is not required, because a time-based lookup can be invoked explicitly with the lookup command and does not have to be configured as an automatic lookup in props.conf.

Answer

The lookup table must have exactly one row per unique time value

Answer

The lookup must be defined as an automatic lookup in props.conf

Question 2

A Splunk user needs to perform a lookup that matches events based on a field 'userid' to a lookup table that contains 'userid', 'full_name', and 'email'. The lookup table is a CSV file named 'users.csv' located in the default lookup directory. The user runs the search: index=main | lookup users.csv userid OUTPUT full_name, email. However, the search returns an error that the lookup table 'users.csv' was not found. What is the most likely reason for this error?

Accepted Answer

The lookup command must reference the lookup definition name, not the CSV file name directly. The `lookup` command in Splunk requires a lookup definition name, not the raw CSV filename. The lookup definition is created in Splunk's configuration (e.g., transforms.conf) and maps a logical name to the actual CSV file. Using the filename directly bypasses this definition, causing Splunk to report the file as not found because it searches for a definition, not the file path.

Answer

The CSV file must have a .csv extension, but the command should omit the extension

Answer

The fields 'full_name' and 'email' are not present in the CSV file

Answer

The CSV file is not in the correct format; it should have a header row

Question 3

A company uses Splunk to monitor web server logs. They have a lookup table that maps IP addresses to geographic locations (city, country). The lookup is defined as a CSV file with fields: ip, city, country. The lookup definition is named 'geo'. The team wants to automatically add city and country to every web event at index time, so that all future searches have this enrichment without adding the lookup command. The team tries to set up an automatic lookup in props.conf for the sourcetype 'web_access', but the city and country fields still do not appear in the events. They verify that the lookup file exists and that the lookup definition works when used manually with the lookup command. What is the most likely cause of the automatic lookup not working?

Accepted Answer

The automatic lookup definition in props.conf is not correctly configured for the intended sourcetype. The automatic lookup definition in props.conf must be correctly configured for the intended sourcetype. The most common misconfiguration is specifying the wrong sourcetype or incorrect syntax in the TRANSFORMS directive, which prevents the lookup from being applied at index time. Since the lookup works manually, the issue is with the props.conf configuration, not the lookup file or definition itself.

Answer

Index-time lookups are not supported; enrichment can only be done at search time

Answer

The lookup file must be in KV Store format for index-time lookups

Answer

The lookup must be invoked with the 'lookup' command in the search to populate the fields

Question 4

A Splunk user wants to see a list of all fields that are extracted from events of sourcetype 'apache_access'. They need to know which fields are available for use in searches and lookups. Which command should they use to discover all fields automatically extracted by Splunk for that sourcetype?

Accepted Answer

Use the search 'sourcetype=apache_access | fields' to list all fields in a few sample events. The `| fields` command, when used without arguments, lists all fields present in the search results. By searching `sourcetype=apache_access` and piping to `| fields`, Splunk returns a table of all extracted fields (both default and custom) from the events of that sourcetype, allowing the user to see which fields are available for searches and lookups.

Answer

Use the 'extract' command with no arguments to show all extracted fields

Answer

Use the 'regex' command with a capturing group to identify fields

Answer

Use the 'inputlookup' command to display field names

Question 5

A Splunk administrator needs to create a field alias that renames the field 'src_ip' to 'source_ip' for events in the index 'network'. The administrator has created the field alias in the Field Aliases settings in the UI. However, when searching index=network, the new field 'source_ip' does not appear in the events. The search still shows 'src_ip'. What could be the reason?

Accepted Answer

The field alias is configured for a specific sourcetype that does not match the events in the index. Field aliases in Splunk are configured per sourcetype. If the alias is applied to a sourcetype that does not match the events in the 'network' index, the alias will not take effect, and the original field name 'src_ip' will continue to appear. The administrator must ensure the alias is assigned to the correct sourcetype(s) present in the index.

Answer

Field aliases only work with lookups, not with standard fields

Answer

The field 'src_ip' is not extracted automatically; an explicit field extraction is required first

Answer

The alias should be created using the 'rename' command in the search, not via the UI

Question 6

A security team uses a KV Store lookup to track threat intelligence indicators (IPs, domains) with a field 'indicator' and a field 'threat_type'. They regularly update the KV Store with new indicators. The team notices that searches using the lookup are very slow when the KV Store contains over 100,000 entries. They want to improve lookup performance without losing the ability to update frequently. Which approach should they take?

Accepted Answer

Add an index on the 'indicator' field in the KV Store collection to speed up lookup queries. Adding an index on the 'indicator' field in the KV Store collection allows Splunk to perform faster lookups by using a B-tree or similar index structure, reducing the need for a full collection scan. This directly addresses the performance degradation seen with over 100,000 entries while still supporting frequent updates, as indexes are maintained dynamically.

Answer

Split the KV Store into multiple smaller KV Stores based on threat_type

Answer

Convert the KV Store to a CSV file and use the lookup command

Answer

Increase the memory allocation for the Splunk search head

Question 7

A company uses Splunk to monitor its e-commerce platform. They have a lookup file (user_geo.csv) that maps user_id to city, state, and country. The search `index=ecommerce sourcetype=access_combined | lookup user_geo user_id OUTPUT city, state, country | stats count by country` is used to analyze user locations. Recently, the lookup stopped returning results for many events. The lookup file is updated daily via a script that pulls from an external API. The Splunk administrator checks the lookup definition and finds that the lookup is configured to automatically reload every 24 hours. The last successful load was 23 hours ago. The events still contain the 'user_id' field. Which course of action should the administrator take first?

Accepted Answer

Manually reload the lookup using the `| inputlookup user_geo.csv | outputlookup user_geo.csv` technique or the UI reload button.. The lookup is configured to auto-reload every 24 hours, and the last successful load was 23 hours ago, so the current lookup data is stale. Manually reloading the lookup forces an immediate refresh, ensuring the latest data from the external API is used. This is the quickest way to resolve missing results without waiting for the next auto-reload.

Answer

Verify that the events contain the `user_id` field by running `index=ecommerce sourcetype=access_combined | head 10`.

Answer

Increase the auto-reload interval to 12 hours to ensure more frequent updates.

Answer

Modify the search to use `| inputlookup user_geo.csv` instead of the lookup command.

Question 8

A security analyst is searching web proxy logs where the 'status' field is extracted automatically. The analyst needs to return only events where the status code is exactly 404, and wants to avoid matching values such as 4040 or 4041. Which search will accomplish this?

Accepted Answer

index=proxy status=404. The bare field=value syntax in SPL filters on an extracted field using an exact match, which returns only events where the status field equals 404. Quoting the value or the whole pair does not change the matching semantics for an exact value, and adding a wildcard broadens the match to include similar values. Exact matching is the correct approach when the analyst wants to exclude 4040, 4041, and similar codes.

Answer

index=proxy status="404"

Answer

index=proxy status=404*

Answer

index=proxy "status=404"

Question 9

A security analyst runs a search but the results contain many events from a noisy internal scanner that is not relevant to the investigation. The analyst wants to remove all events where the field 'src_ip' equals '10.10.10.50' from the result set. Which SPL command should the analyst use?

Accepted Answer

search src_ip!=10.10.10.50. The != operator is the correct way to exclude events with a specific field value while also filtering out events where that field is absent. Using src_ip=10.10.10.50 would do the opposite and keep only the noisy scanner events. The fields command and dedup command do not remove events based on a value condition, so they do not accomplish the filtering task.

Answer

search src_ip=10.10.10.50

Answer

dedup src_ip

Answer

fields - src_ip

Question 10

A Splunk admin is troubleshooting a lookup that is not returning expected results. The lookup definition uses the CSV file 'products.csv' with fields 'product_id' and 'product_name'. The search is `index=main | lookup products product_id OUTPUT product_name`. The admin confirms that the events contain a field 'product_id' with values like 'P123', and the CSV has a row with 'P123,Widget'. However, the product_name field is not appearing. Which of the following is the most likely cause?

Accepted Answer

The lookup definition is configured to match on a different field than 'product_id', or the CSV file has a different field name.. For a lookup to work, the field used in the search must correspond to a field defined in the lookup table. If the lookup definition or the CSV header uses a different field name than the one in the events, no match occurs. The admin should verify that the lookup definition's match field and the CSV header both use 'product_id' exactly.

Answer

The lookup file is not configured with the correct permissions for the user's role.

Answer

The lookup definition does not have case-sensitive matching enabled, and the values differ in case.

Answer

The product_id field in the events is not extracted correctly, or the field name in the lookup definition does not match.

Question 11

A Splunk user runs a search and wants to see a list of all fields that were extracted from the events, along with their values, in a tabular format. Which command should the user add to the search to display the fields and their values?

Accepted Answer

fieldsummary. The fieldsummary command is designed to provide a summary of all fields present in the search results, showing statistics like count and distinct count for each field. It outputs a table that lists each field and its summary values, making it ideal for quickly understanding which fields are available and their characteristics. Other commands like table or fields do not automatically generate this summary.

Answer

transpose

Answer

fields *

Answer

table *

Question 12

A security analyst wants to enrich events with data from a CSV lookup file named `threat_intel.csv` that contains `ip`, `threat_type`, and `severity` columns. The events contain a field called `src_ip`. The analyst wants to add the matching `threat_type` and `severity` fields to each event but does not want to drop events that have no match in the lookup. Which SPL command should the analyst use?

Accepted Answer

lookup threat_intel ip AS src_ip OUTPUT threat_type, severity. The `lookup` command enriches events by matching a field in the event to a field in a lookup table and adding specified output fields. It preserves all events by default, which aligns with the requirement to not drop non-matching events. The syntax `lookup AS OUTPUT ` is correct. The other options either use incorrect syntax or drop events.

Answer

lookup threat_intel src_ip AS ip OUTPUTNEW threat_type, severity

Answer

inputlookup threat_intel WHERE src_ip=ip | fields threat_type, severity

Answer

join src_ip [| inputlookup threat_intel | rename ip AS src_ip]

Question 13

A Splunk user is investigating authentication failures and wants to see only events where the 'action' field equals 'failure'. The user runs a search that returns all authentication events and now needs to filter the results. Which search command should the user add to keep only the failure events?

Accepted Answer

search action=failure. The search command filters events by matching field values and is the correct tool for retaining only events where action equals failure. It can be used both at the start of a search and later in the pipeline to narrow results. The where command could also filter, but it requires a proper comparison expression rather than the simple field=value syntax shown.

Answer

filter action=failure

Answer

eval action=failure

Answer

where action=failure

Question 14

A Splunk user wants to display a list of all fields that have been extracted from a specific sourcetype, including their values for a sample event. Which command should they use?

Accepted Answer

Field picker in the Search app. The Field picker in the Splunk Search app provides a list of all fields extracted from the events in the current search. It shows field names and sample values, allowing users to understand what fields are available for a given sourcetype. It is the standard way to discover fields without using a specific command.

Answer

fieldformat

Answer

fieldsummary

Answer

fields

Question 15

A Splunk administrator needs to create a lookup definition that references a CSV file stored in a custom app. The lookup must be case-insensitive when matching the field 'host_name'. Which configuration setting in the lookup definition's transforms.conf stanza accomplishes this?

Accepted Answer

case_sensitive = false. The case_sensitive setting in transforms.conf is the correct parameter to control case sensitivity for lookup matching. Setting it to false enables case-insensitive matching, which is necessary when event field values may vary in case compared to the lookup table. This ensures that matches occur regardless of capitalization differences.

Answer

ignore_case = true

Answer

case_insensitive = 1

Answer

match_case = 0