SPLK-1001 Using Fields and Lookups Practice Test 5 — 15 Questions

Question 1

A user creates a calculated field that extracts the domain from email addresses using the expression `| rex field=email "(?P<domain>@\w+\.\w+)"`. However, the calculated field does not appear in search results. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Calculated fields must be enabled in props.conf with REPORT clauses.. Calculated fields in Splunk require explicit configuration in props.conf using a REPORT clause to define the extraction. Without this configuration, the calculated field is not available for use in searches, even if the extraction expression is valid. The user's calculated field definition is missing the necessary props.conf setup, so it never gets applied.

Answer

Calculated fields are only applied at search time, not index time.

Answer

The field extraction is incorrect.

Answer

Calculated fields must be used with the `eval` command.

Question 2

An automatic lookup is configured but it is not enriching events. The lookup file is large (100MB) and is updated daily. What setting could improve performance?

Accepted Answer

Enable `batch_index_lookup = true`. Enabling `batch_index_lookup = true` in transforms.conf allows Splunk to process the entire 100MB lookup file in a single batch operation rather than performing individual lookups for each event. This significantly reduces I/O overhead and improves performance for large, daily-updated lookup files by loading the entire lookup into memory once per batch.

Answer

Set `filter` in transforms.conf

Answer

Increase `max_matches`

Answer

Use `| lookup` instead of automatic

Question 3

A user wants to view the contents of a lookup table file named `users.csv` that is stored in Splunk. Which two commands can be used? (Choose two.)

Accepted Answer

`| inputlookup users.csv`. `| inputlookup users.csv` reads the contents of a static lookup table file named `users.csv` directly from Splunk's lookups directory. Option B is correct because `| inputlookup users` references the lookup by its defined name in transforms.conf, which maps to the file `users.csv`; this is the standard way to access a lookup that has been configured as a lookup definition.

Answer

`| fields users.csv`

Answer

`| outputlookup users.csv`

Answer

`| lookup users.csv`

Question 4

Which of the following are valid reasons to use a lookup in Splunk? (Choose two.)

Accepted Answer

To enrich events with additional information from an external source.. A lookup in Splunk enriches events by adding fields from an external source, such as a CSV file, KV store, or scripted lookup, based on a matching field in the event. This allows you to bring in contextual data (e.g., user names, device details) without modifying the original raw data.

Answer

To create new fields using the eval command.

Answer

To alias field names permanently.

Answer

To change the timestamp format of events.

Question 5

A lookup definition in transforms.conf includes the following settings: `filename = employees.csv`, `max_matches = 0`, `case_sensitive_match = false`. Which three statements about this lookup are true? (Choose three.)

Accepted Answer

The lookup matching is case-insensitive.. The `case_sensitive_match = false` setting in transforms.conf explicitly makes the lookup matching case-insensitive. This means that when the lookup is performed, the comparison between the event field value and the lookup key ignores differences in uppercase and lowercase characters.

Answer

The lookup will fail if there are duplicate keys.

Answer

The lookup will only return the first match for each event.

Question 6

Refer to the exhibit. A user runs a search with `| lookup excel_lookup product_id OUTPUT sales_rep`. For a product_id that exists in the CSV but with a different case (e.g., "ABC123" vs "abc123"), what will be the value of the `sales_rep` field after the lookup?

Accepted Answer

"N/A" because the case does not match and default_match is set.. The `| lookup` command in Splunk is case-sensitive by default. When the product_id in the event has a different case than the lookup file, the lookup fails to find a match. If the lookup definition has `default_match` set to a value like 'N/A', that default value is returned for the `sales_rep` field instead of the actual lookup value.

Answer

The correct sales_rep from the lookup.

Answer

An error because case mismatch.

Answer

An empty string because no match.

Question 7

Refer to the exhibit. The lookup `usertable` has fields: user, role, department. The search returns an error: "Error in 'where' command: Field 'role' is not defined." What is the most likely cause?

Accepted Answer

The lookup file does not have a column named 'role'.. The error 'Field ''role'' is not defined' in the `where` command indicates that the field 'role' does not exist in the events being processed. Since the `inputlookup` command loads the lookup file into the search pipeline, the most likely cause is that the lookup file does not contain a column named 'role'. Option D correctly identifies this root cause.

Answer

The `inputlookup` command does not output fields that can be used with `where`.

Answer

The field 'role' is not a valid field in the lookup because it is a reserved word.

Answer

The lookup name 'usertable' is misspelled.

Question 8

Refer to the exhibit. An automatic lookup is configured with WILDCARD match type. What kind of matching does this enable?

Accepted Answer

Matching based on prefixes or suffixes using wildcards.. An automatic lookup configured with WILDCARD match type enables matching based on prefixes or suffixes using wildcards. This allows the lookup to match field values that contain a wildcard character (e.g., * or ?) to represent variable parts of the string, enabling flexible pattern matching beyond exact equality.

Answer

Exact match only.

Answer

Case-insensitive match.

Answer

Matching only on the first N characters.

Question 9

A security analyst wants to count the number of unique users who have logged in over the past week. Which field-based command should they use?

Accepted Answer

index=main sourcetype=login | dedup user | stats count. It first uses `dedup user` to remove duplicate user values, leaving only unique users, and then `stats count` to count the remaining events, which effectively counts the number of unique users who logged in over the past week. This approach ensures each user is counted only once, meeting the requirement for a unique count.

Answer

index=main sourcetype=login | stats sum(user)

Answer

index=main sourcetype=login | stats count by user

Answer

index=main sourcetype=login | top user

Question 10

A user has a lookup file containing employee email addresses and department names. They want to add the department field to search results containing the employee's email. Which command should they use?

Accepted Answer

lookup employee_department.csv email OUTPUT department. The `lookup` command is designed to enrich search results by matching a field in the events (e.g., email) against a lookup table (e.g., employee_department.csv) and outputting additional fields (e.g., department). Option B correctly uses the syntax `lookup employee_department.csv email OUTPUT department`, which performs a field-based lookup and appends the department field to matching events.

Answer

inputlookup employee_department.csv

Answer

eval department=employee_department(email)

Answer

outputlookup employee_department.csv

Question 11

An analyst runs a search and notices that a field `status_code` contains values like '200', '404', '500'. They want to categorize these as 'Success' or 'Error'. Which approach is most efficient?

Accepted Answer

Use eval with case function to map status codes to categories directly in the search.. Using `eval` with `case` is the most efficient approach for a simple, static mapping of status codes to categories directly within the search pipeline. It avoids the overhead of disk I/O and lookup table management, and it executes entirely in memory on the search head or indexer, making it ideal for small, hardcoded mappings.

Answer

Use the csv file as a lookup and inputlookup to filter.

Answer

Create a lookup table with status codes and categories, then use the lookup command.

Answer

Use the rename command to change field values.

Question 12

A Splunk administrator receives a complaint that a saved search is slow. The search uses a lookup to enrich events with a CSV file that has 500,000 rows. Which optimization is most effective?

Accepted Answer

Filter events early using eval or where before applying the lookup.. Filtering events early with `eval` or `where` reduces the volume of data that must be processed by the lookup command. Since lookups perform a row-by-row match against a 500,000-row CSV, minimizing the number of events before the lookup drastically cuts I/O and CPU overhead, making the search faster.

Answer

Sort events by the lookup key field before the lookup command.

Answer

Convert the CSV lookup to a KV store lookup for faster access.

Answer

Increase the search time range to process more events at once.

Question 13

An analyst wants to compute the average response time for each server from web server logs. The field `response_time` is a string like '120ms'. What is the correct way to convert and compute?

Accepted Answer

eval response_num=replace(response_time, "ms", "") | eval response_num=response_num*1 | stats avg(response_num) by server. It first uses `replace` to strip the 'ms' suffix from the string field `response_time`, then multiplies the resulting string by 1 (`response_num*1`) to coerce it into a numeric type. Only after conversion can `stats avg(response_num) by server` compute a meaningful average. Without the numeric coercion, Splunk would treat the field as a string and either fail or produce incorrect results.

Answer

eval response_time=response_time + "0" | stats avg(response_time) by server

Answer

eval response_num=replace(response_time, "ms", "") | stats avg(response_num) by server

Answer

eval avg_response=avg(response_time)

Question 14

A team uses a lookup to map IP addresses to geographic locations. The lookup is large and updated weekly. Which lookup type is best suited?

Accepted Answer

File-based CSV lookup. A file-based CSV lookup is best suited for this use case because it is static, large, and updated on a schedule. CSV lookups are loaded into memory and can handle large datasets efficiently, and they are easily replaced or updated weekly by overwriting the file. This approach avoids the overhead of a KV store or external service for a dataset that does not require real-time updates or complex queries.

Answer

External lookup

Answer

Scripted lookup

Answer

KV store lookup

Question 15

A search includes a lookup that returns multiple matches for a single event. The analyst wants to keep only the first match. Which lookup command option should they use?

Accepted Answer

max_matches=1. Max_matches=1. This option limits the number of lookup matches per event to one, keeping only the first match. Option A (update=t) is used for outputlookup to update existing entries, not for limiting matches. Option B (local=t) refers to local time-based lookups, which is not relevant here. Option D (append=t) appends fields from a lookup but does not limit the number of matches.

Answer

update=t

Answer

local=t

Answer

append=t