SPLK-1001 Using Fields and Lookups Practice Test 6 — 15 Questions

Question 1

A Splunk user has a lookup file named 'users.csv' that contains the fields 'user_id' and 'department'. The user wants to add the 'department' field to events that contain a 'user_id' field. However, the field in the events is named 'uid' instead of 'user_id'. Which search syntax will correctly add the 'department' field to the events?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

lookup users.csv user_id AS uid OUTPUT department. When the event field name differs from the lookup field name, the lookup command requires an AS clause to map the lookup field to the event field. The syntax is 'lookup AS OUTPUT '. In this case, 'user_id AS uid' correctly maps the lookup's 'user_id' to the event's 'uid', allowing the department to be added.

Answer

lookup users.csv uid AS user_id OUTPUT department

Answer

lookup users.csv user_id OUTPUT department

Answer

lookup users.csv uid OUTPUT department

Question 2

A Splunk user is investigating a suspicious login and wants to see all events where the `user` field is exactly 'admin' and the `action` field is 'failure'. Which search syntax will return only those events?

Accepted Answer

user=admin action=failure. In Splunk, field-value pairs placed together are implicitly combined with AND. Therefore, `user=admin action=failure` correctly filters events where both conditions are met. Using OR would broaden the results incorrectly, and adding redundant AND is unnecessary. The correct syntax is concise and efficient.

Answer

user=admin OR action=failure

Answer

user=admin AND action=failure

Answer

user=admin action=failure OR user=admin

Question 3

A Splunk user has a lookup named 'employee_info' defined with the columns 'emp_id', 'full_name', and 'manager'. A search returns events containing a field named 'employee_number'. The user runs a lookup command that matches employee_number to emp_id and returns only the full_name column. Later, the user needs to also return the manager column but wants to avoid redefining the lookup. Which approach adds the manager value to the events while keeping the full_name value already present?

Accepted Answer

Add a second lookup command that matches employee_number to emp_id and uses OUTPUT manager.. Adding a separate lookup command with OUTPUT manager reuses the same lookup definition and appends the manager field without disturbing the full_name value already added. OUTPUT always writes the specified field, whereas OUTPUTNEW would skip events that already have a manager field. This approach avoids modifying the original lookup command and meets the requirement cleanly.

Answer

Add a second lookup command that uses OUTPUTNEW manager after the first lookup.

Answer

Use the inputlookup command to read employee_info and append the manager column to the events.

Answer

Modify the first lookup command to use OUTPUT full_name, manager instead of OUTPUT full_name.

Question 4

A Splunk administrator needs to enrich events with user department information from a CSV lookup named `user_departments.csv`. The lookup contains fields `user_id` and `department`. The events have a field `user` that matches `user_id`. The administrator wants to add the `department` field to each event without removing any existing fields. Which SPL command should be used?

Accepted Answer

| lookup user_departments.csv user_id AS user OUTPUT department. The `lookup` command is designed to enrich events by matching an event field to a lookup field and adding specified output fields. The correct syntax is `lookup

AS OUTPUT `. In this case, the lookup field is `user_id` and the event field is `user`, so `user_id AS user` is correct. The `OUTPUT department` clause adds the department field without removing existing fields. Other methods like `join` or `inputlookup` are less efficient and require additional field renaming.

Answer

| inputlookup user_departments.csv | join user [search index=main]

Answer

| lookup user_departments.csv user AS user_id OUTPUT department

Answer

| join user_id [inputlookup user_departments.csv]

Question 5

A Splunk user is working with a lookup table that maps product codes to product names. The user wants to ensure that the lookup is automatically applied to all events containing the 'product_code' field, without having to include the lookup command in every search. Which two configurations are required to achieve this? (Choose two.)

Accepted Answer

Add an automatic lookup stanza in props.conf that references the lookup definition and specifies the match field.. To automatically apply a lookup to events, you must first define the lookup in transforms.conf, which tells Splunk how to access the CSV file and which fields to match. Then, you configure an automatic lookup in props.conf that references this definition and specifies the event field to match on. Together, these settings make the lookup run automatically for relevant events.

Answer

Add the lookup command to the search macro that is used for all searches.

Answer

Create a field alias for the product_code field in props.conf.

Answer

Use the outputlookup command to write the lookup results back to the CSV file.

Question 6

A Splunk administrator needs to create a lookup definition that references a CSV file stored in the `lookups` directory. The lookup will be used to match on a field called `user_id` and return the `department` and `manager` fields. The administrator wants to ensure that the lookup is case-insensitive and that events without a match are not dropped. Which configuration should the administrator use when creating the lookup definition?

Accepted Answer

Set the lookup type to 'File-based' and configure the match type to 'WILDCARD(user_id)' with case sensitivity disabled.. For a CSV-based lookup, the lookup definition should be file-based. To achieve case-insensitive matching, the match type should be set to WILDCARD and the case sensitivity option should be disabled. This ensures that user IDs match regardless of case, and the lookup enriches events without dropping non-matching events. The other options either use incorrect match types or the wrong lookup type.

Answer

Set the lookup type to 'File-based' and configure the match type to 'CIDR(user_id)'.

Answer

Set the lookup type to 'File-based' and configure the match type to 'EXACT(user_id)' with case sensitivity disabled.

Answer

Set the lookup type to 'KV Store' and configure the match type to 'EXACT(user_id)' with case sensitivity enabled.

Question 7

A Splunk administrator is configuring a lookup definition to enrich events with geographic data from a CSV file. The lookup file `geo.csv` contains fields `ip`, `country`, and `city`. The events have a field `src_ip`. The administrator wants to ensure the lookup matches correctly and efficiently. Which two actions should be taken? (Choose two.)

Accepted Answer

In the search, use `| lookup geo.csv ip AS src_ip OUTPUT country city` to match the event field `src_ip` to the lookup field `ip`.. To correctly enrich events with geographic data, the lookup must be defined in `transforms.conf` with the appropriate filename and matching settings, and the search must use the `lookup` command with the `AS` clause to map the event field `src_ip` to the lookup field `ip`. This ensures accurate matching and efficient enrichment. Using `inputlookup` with `join` is inefficient and requires field renaming, while field aliases and `max_matches` are not necessary for this scenario.

Answer

Use `| inputlookup geo.csv | join src_ip` to combine the lookup with events.

Answer

Create a field alias in `props.conf` to rename `src_ip` to `ip` for all events.

Answer

Set `max_matches = 1` in the lookup definition to ensure only the first match is returned.

Question 8

A Splunk administrator is troubleshooting a lookup that is not returning expected results. The lookup is defined in transforms.conf with the setting 'max_matches = 1'. The administrator notices that some events are not being enriched with the lookup data even though the match field values appear to exist in the lookup table. What is the most likely cause of the missing enrichment?

Accepted Answer

The lookup definition is missing the case_sensitive = false setting, so matching is case-sensitive and events with different casing are not matched.. The most likely cause is that the lookup matching is case-sensitive by default. If the event field values differ in case from the lookup table, those events will not match. Setting case_sensitive = false in the lookup definition would resolve this. The max_matches setting is not the primary cause here.

Answer

The lookup file is not in the correct directory, so Splunk cannot find it and returns no matches.

Answer

The max_matches setting should be set to 0 to allow unlimited matches, otherwise only one event can be enriched.

Answer

The lookup table contains duplicate values in the match field, and max_matches = 1 causes only the first match to be used, but some events may match later duplicates.

Question 9

A Splunk admin wants to enrich web server logs with geographic location data based on IP addresses. Which approach should they use?

Accepted Answer

Configure a lookup definition and use lookup command. Splunk's lookup command, combined with a lookup definition that references a geographic IP-to-location database (such as MaxMind GeoLite2), allows the admin to enrich web server logs with fields like city, country, and coordinates based on the client IP address. This is the standard, efficient approach for IP geolocation enrichment in Splunk, as it leverages pre-built external data without requiring custom parsing or calculations.

Answer

Use rex to extract location from the IP

Answer

Use an eval command to calculate coordinates

Answer

Use fields command to add location

Question 10

A search includes a lookup that returns multiple values per event. The admin wants to see each matched value as a separate event. Which command should be used after the lookup?

Accepted Answer

mvexpand. The `mvexpand` command is correct because it takes a multivalue field (such as one created by a lookup returning multiple matches) and expands it into separate events, one for each value. This allows the admin to see each matched value as an individual event, which is exactly the requirement.

Answer

untable

Answer

stats

Answer

makemv

Question 11

In Splunk, which of the following is true about fields?

Accepted Answer

Fields are extracted at search time from raw data. In Splunk, fields are extracted at search time from raw data using the Search Processing Language (SPL) and the default field extraction rules. This allows Splunk to dynamically identify and index field-value pairs without requiring predefined schemas, enabling flexible ad-hoc analysis of unstructured or semi-structured data.

Answer

Fields must be manually defined before indexing

Answer

Fields are only available after using the fields command

Answer

All fields are predefined by Splunk

Question 12

A search uses a lookup that returns a field 'priority'. The admin wants to use the lookup only for events where the 'source' is 'firewall'. Which command should be used?

Accepted Answer

source=firewall | lookup priority_lookup source OUTPUT priority. It first filters events with `source=firewall` using a search-time field filter, then applies the `lookup` command only to those events. This ensures the lookup is performed exclusively on firewall events, minimizing resource usage and avoiding unnecessary lookups on other sources.

Answer

| lookup priority_lookup source OUTPUT priority

Answer

| lookup priority_lookup source OUTPUT priority | where source="firewall"

Answer

| lookup priority_lookup source OUTPUT priority WHERE source="firewall"

Question 13

Which of the following best describes the purpose of the 'fields' command in a search?

Accepted Answer

To keep or remove specified fields from events. The 'fields' command in Splunk is used to either keep (include) or remove (exclude) specified fields from search results. By default, all extracted fields are returned, but 'fields' allows you to narrow the output to only relevant fields (e.g., `fields clientip, status`) or to drop unwanted fields (e.g., `fields - _raw`). This improves readability and performance by reducing the data volume passed to subsequent commands.

Answer

To rename existing fields

Answer

To add fields from a lookup table

Answer

To extract new fields from raw data

Question 14

A user wants to create a field that contains the length of the 'message' field. Which command should they use?

Accepted Answer

eval msg_length=len(message). The `eval` command in Splunk is used to create or modify fields, and the `len()` function returns the character length of a string field. The syntax `eval msg_length=len(message)` creates a new field named `msg_length` containing the length of the `message` field.

Answer

rex field=message "(?<msg_length>.*)"

Answer

eval msg_length=sizeof(message)

Answer

len(message)

Question 15

Which TWO of the following are valid ways to extract fields in Splunk? (Choose two.)

Accepted Answer

Using the Extract New Fields dialog in the UI. Option B is correct because the Extract New Fields dialog in the Splunk UI lets you interactively highlight values in raw events and define a regex-based field extraction, which Splunk then saves as a field extraction (often to props.conf/transforms.conf) so the field is parsed from raw data. Option C is correct because the rex command performs inline regular-expression field extraction during a search, using named capture groups such as (?<fieldname>...) to create fields from raw event text. Option A is not a field-extraction method; lookups enrich or add fields by matching existing field values against an external table, they do not parse new fields out of raw data. Option D is incorrect because the fields command only includes or excludes fields that already exist in the results (fields +/-, fields -), it does not extract them. Option E is incorrect because there is no regex command in Splunk's search processing language; regex-based extraction is done with rex (or the regex eval function for matching/filtering, not field extraction).

Answer

Using a lookup to extract fields from raw data

Answer

Using the fields command

Answer

Using the regex command in a search