SPLK-1001 Using Fields and Lookups Practice Test 7 — 15 Questions

Question 1

Which THREE of the following are true about lookups in Splunk? (Choose three.)

Accepted Answer

A lookup can be defined using a CSV file. Option A is correct because Splunk supports file-based lookups, where a CSV file is uploaded or referenced and defined via a lookup definition (e.g., in transforms.conf with filename = mylookup.csv), making CSV one of the standard lookup table types. Option D is correct because the core purpose of a lookup is to enrich events by adding fields from an external source such as a CSV, KV Store collection, or external script, typically invoked with the lookup command or automatic lookups. Option E is correct because Splunk supports time-based lookups (temporal lookups), where a time field in the lookup table is matched against the event time to return the appropriate value for that time range. Option B is not correct because lookups are case-sensitive by default; case-insensitive matching must be explicitly enabled (e.g., case_sensitive_match = false in the lookup definition). Option C is not correct because a lookup can return multiple fields, not just a single field, as defined by the lookup table's columns.

Answer

Lookups are case-insensitive by default

Answer

Lookups can only return a single field

Question 2

Which THREE statements about the 'rex' command are correct? (Choose three.)

Accepted Answer

rex can be used to extract fields from any string field. Option A is correct because the rex command is a Splunk search command that applies a regular expression to any string field (not just _raw) and extracts new fields from it via the max_match and field arguments. Option B is correct because rex supports named capturing groups in the form (?<name>pattern), which become the extracted field names in the results. Option E is correct because rex can overwrite an existing field when the named capture group matches an already-present field name, effectively modifying that field's value. Option C is incorrect because rex can extract multiple fields in a single invocation by using multiple named capturing groups in one regular expression. Option D is incorrect because rex leaves extracted values as strings and does not automatically cast them to numeric types; a separate conversion such as the eval or convert command is required.

Answer

rex can only extract one field per command

Answer

rex automatically converts extracted values to numeric

Question 3

Refer to the exhibit. The lookup file app_versions.csv contains fields 'app' and 'version'. The version values are strings like '1.5', '2.0', '2.1'. What is the issue with this search?

Accepted Answer

Version comparison will not be numeric, giving incorrect results. The issue is that the `where` clause performs lexicographic (string) comparison on the `version` field because the values in the lookup file are stored as strings (e.g., '1.5', '2.0', '2.1'). Since string comparison evaluates character by character, a version like '2.0' would be considered greater than '10.0' because '2' > '1' as a character, leading to incorrect filtering results. To compare versions numerically, you must convert the field to a numeric type using functions like `tonumber()` or parse the version string into comparable components.

Answer

where cannot be used with string comparisons

Answer

inputlookup is not a valid command

Answer

table should be replaced with fields

Question 4

Refer to the exhibit. What will this search return?

Accepted Answer

The 5 most common URI values. The `top` command in SPL returns the most common values of a field, sorted by count in descending order, limited by default to 10 results. Since the search specifies `limit=5`, it returns the 5 most frequent URI values, making option C correct.

Answer

A time chart of URI counts

Answer

A statistical summary of URI lengths

Answer

A list of all URI values

Question 5

A user notices that a calculated field defined in props.conf is not appearing in search results. Which of the following is the most likely cause?

Accepted Answer

The source fields used in the calculation are not extracted.. Calculated fields in Splunk are evaluated at search time based on existing extracted source fields. If the source fields referenced in the calculation are not extracted (e.g., due to missing or incorrect field extraction configurations), the calculated field will not appear in search results. Option B correctly identifies this dependency.

Answer

The calculated field requires index-time field extraction.

Answer

The calculated field is defined in a field alias configuration.

Answer

The indexer is not configured to apply calculated fields.

Question 6

A Splunk administrator is configuring a lookup to enrich firewall logs with a static CSV file containing allowed IP ranges. Which TWO statements about lookup configuration are correct?

Accepted Answer

The lookup definition must include the fields to match on from the event data.. Option B is correct because a lookup definition (transforms.conf stanza) must specify the match fields — the event fields used to join against the lookup table's columns — so Splunk knows which values to compare when enriching firewall logs. Option C is correct because static CSV lookups can be uploaded directly via Settings > Lookups > Lookup table files, which stores the file in the app's lookups directory and makes it available for a lookup definition. Option A is wrong because KV Store lookups are for dynamic, mutable data, not static CSV tables, which use file-based (CSV) lookups. Option D is wrong because lookup definitions live in transforms.conf, not macros.conf (macros.conf holds search macros). Option E is wrong because the CSV is typically placed in the app's lookups directory (e.g., $SPLUNK_HOME/etc/apps/<app>/lookups) or uploaded via the UI, not required to be at an absolute path on the search head.

Answer

A KV Store lookup is required for static tables.

Answer

The lookup is defined in macros.conf.

Answer

The CSV file must be placed in an absolute path on the search head.

Question 7

An administrator needs to extract a field from log data where the value appears between two square brackets, for example [error_code: 404]. Which search command should they use to create a custom field extraction without modifying the original data?

Accepted Answer

rex. The `rex` command is used to extract fields using regular expressions without modifying the raw event data. In this scenario, `rex` can parse the pattern `$$error_code: (?<field>\d+)$$` to capture the value between square brackets into a new field, leaving the original log intact.

Answer

eval

Answer

fields

Answer

extract

Question 8

A security analyst wants to enrich authentication logs with a lookup table containing user department and manager information. Which TWO statements are true about using lookups in Splunk?

Accepted Answer

The inputlookup command can be used to load a lookup file into a search.. Option B is correct because the inputlookup command reads the contents of a lookup table (CSV or KV Store) directly into the search pipeline, letting the analyst inspect or join the department and manager data without an external event source. Option E is correct because automatic lookups are defined by a lookup definition stanza in transforms.conf and then invoked at search time via a stanza in props.conf, so matching fields in authentication logs are enriched automatically without an explicit lookup command. Option A is wrong because lookups are dynamic and can be edited, replaced, or refreshed at any time. Option C is wrong because lookups can also be backed by KV Store collections, not just CSV files. Option D is wrong because lookup definitions support multiple matching fields through the fields_list setting.

Answer

Once a lookup is defined, it cannot be updated.

Answer

Lookups can only be created from CSV files.

Answer

Lookups can only match on a single field.

Question 9

Drag and drop the steps to configure Splunk to use LDAP authentication into the correct order.

Accepted Answer

Select LDAP as authentication method, then configure LDAP server settings, then map LDAP groups to Splunk roles, then test the LDAP configuration.. LDAP setup involves selecting the method, configuring server details, mapping groups, and testing.

Answer

Map LDAP groups to Splunk roles, then configure LDAP server settings, then select LDAP as authentication method, then test the LDAP configuration.

Answer

Test the LDAP configuration, then select LDAP as authentication method, then configure LDAP server settings, then map LDAP groups to Splunk roles.

Answer

Select LDAP as authentication method, then test the LDAP configuration, then configure LDAP server settings, then map LDAP groups to Splunk roles.

Question 10

Match each search mode to its behavior.

Accepted Answer

Fast mode: Returns only fields referenced in the search, improving performance.. Splunk search modes: Fast returns only search-referenced fields; Smart dynamically selects fields; Verbose returns all fields. Confusing these leads to incorrect expectations about performance and output.

Answer

Fast mode: Returns all fields for each event.

Answer

Verbose mode: Returns only fields referenced in the search.

Question 11

A user wants to rename the field 'src_ip' to 'sourceIP' in all search results without modifying the raw data. Which method should they use?

Accepted Answer

Use the rename command: | rename src_ip as sourceIP. The `rename` command is the correct choice because it changes the field name in the search results without altering the underlying raw data. It operates on the field metadata in the search pipeline, allowing you to display 'sourceIP' instead of 'src_ip' for the duration of the search.

Answer

Use the eval command to assign src_ip to a new field sourceIP

Answer

Add an alias in props.conf

Answer

Use the fields command: | fields src_ip as sourceIP

Question 12

A security team needs to enrich their authentication events with risk scores from a CSV file that maps username to risk_score. The CSV is updated daily and has 100,000 rows. Which lookup configuration is most appropriate?

Accepted Answer

Configure a CSV lookup and use lookup command in search. A CSV lookup is the simplest and most efficient way to enrich events with static data from a file that is updated daily. The `lookup` command can be used in search to match the username field from events to the username column in the CSV and add the risk_score field. For 100,000 rows, a CSV lookup is appropriate as it is loaded into memory and can be refreshed by replacing the file, without needing complex infrastructure.

Answer

Use a time-based lookup to match event time with lookup time

Answer

Set up an external lookup that calls a REST API

Answer

Create a KV Store lookup and update it via REST

Question 13

A user wants to see the list of all fields that are extracted from a specific sourcetype. Which command should they use?

Accepted Answer

| fieldsummary. The `fieldsummary` command provides a summary of all fields extracted from the events in the search results, including their count, distinct count, and percentage of events containing each field. When applied to a specific sourcetype, it lists every field that has been extracted from that sourcetype, making it the correct tool for this task.

Answer

| rex field=_raw ...

Answer

| fields *

Answer

| eval fields=...

Question 14

Your team uses a large CSV lookup 'users.csv' with 200,000 rows. When running searches that use this lookup via the lookup command, performance is slow. Which action would most improve performance?

Accepted Answer

Add an index to the lookup file by converting to KV Store. To improve performance with a large CSV lookup (200,000 rows), converting it to a KV Store (Option C) is the best choice because KV Store lookups are indexed, making field matching much faster than searching the entire CSV file each time. Option A (external lookup) is wrong because querying a database adds network and database overhead, often slowing performance further. Option B (increasing timeout) does not speed up the lookup; it only prevents timeouts during long operations. Option D (increasing max_matches) controls how many matching results are returned, but does not affect the speed of the lookup operation itself.

Answer

Switch to an external lookup that queries a database

Answer

Increase the lookup timeout value

Answer

Increase the max_matches setting for the lookup

Question 15

An administrator notices that an automatic lookup is not being applied to events from a certain sourcetype. The lookup file exists and the configuration in props.conf appears correct. What is a possible reason?

Accepted Answer

The lookup table is defined in transforms.conf incorrectly. The automatic lookup is defined in props.conf, but the actual lookup table configuration (including the lookup file name, field mappings, and match type) is specified in transforms.conf. If transforms.conf is missing, has a syntax error, or incorrectly defines the lookup (e.g., wrong filename, mismatched field names, or incorrect stanza name), the automatic lookup will fail silently, even if props.conf appears correct.

Answer

Splunk needs to be restarted after adding the automatic lookup

Answer

The lookup file is stored in the wrong directory but referenced correctly

Answer

The lookup field is case-sensitive and the data doesn't match