SPLK-1001 Using Fields and Lookups Practice Test 7 — 15 Questions

Question 1

A search uses the rex command to extract fields from a log line. The field extraction is working correctly, but some events are missing the extracted field. What is a possible reason?

Accepted Answer

The events that are missing the field do not contain the pattern.. The rex command extracts fields by matching a regex pattern against the raw event text. If an event does not contain the substring that matches the pattern, no field is extracted. This is the most direct and common reason for missing fields — the pattern simply isn't present in those events.

Answer

The rex command does not support named groups.

Answer

The regex pattern is too complex.

Answer

The rex command must be used with eval.

Question 2

An analyst needs to create a lookup file. Which TWO methods can be used?

Accepted Answer

Upload a CSV file via the Lookups UI.. The Lookups UI in Splunk Web provides a direct method to upload a CSV file and create a lookup table file (static lookup) without needing to write any commands. Option E is correct because the `outputlookup` command writes the results of a search directly into a lookup file, creating or appending to a lookup definition. Both are standard methods for creating lookup files in Splunk.

Answer

Use inputlookup command.

Answer

Use rex to parse and then outputcsv.

Answer

Use eval to create a table and then export.

Question 3

Which THREE of the following are capabilities of the rex command?

Accepted Answer

Extract fields using regex named groups.. The `rex` command can extract fields using regex named groups, where the group name becomes the field name and the matched value becomes the field value. This is a core capability of `rex` for field extraction in Splunk.

Answer

Perform case-insensitive extraction by default.

Answer

Set a default value for a field.

Question 4

Which TWO commands can be used to bring lookup data into a search?

Accepted Answer

inputlookup. The `inputlookup` command is used to load the contents of a static lookup table (CSV or KV store) into the search pipeline as events, making it available for further processing. The `lookup` command enriches search results by adding fields from a lookup table based on a field match, effectively bringing lookup data into the search context. Both commands allow lookup data to be used within a search, but in different ways: `inputlookup` loads the entire table as events, while `lookup` appends fields to existing events.

Answer

outputlookup

Answer

csvlookup

Answer

filelookup

Question 5

Refer to the exhibit. An analyst runs a search that uses this lookup. The lookup returns multiple matches for some events. Which of the following is true?

Accepted Answer

Only the first 5 matching rows are returned.. By default, Splunk's lookup command returns only the first matching row from the lookup table when multiple matches exist for a single event. This behavior is controlled by the `max_matches` parameter, which defaults to 1, but the question states that the first 5 matching rows are returned, indicating that the `max_matches` setting has been explicitly configured to 5. The lookup command does not automatically return all matches or require a sorted lookup file for this behavior.

Answer

The default value 'UNKNOWN' is used when there is no match.

Answer

All matching rows are returned for each event.

Answer

The lookup file must be sorted.

Question 6

Refer to the exhibit. An administrator runs this command. What is the effect?

Accepted Answer

Returns the contents of the CSV file as search results.. The command `inputlookup` reads the contents of the specified CSV file and returns them as search results. It does not create a lookup definition or persistent data input; it is a one-time import for the current search.

Answer

Creates a lookup definition named my_lookup using the file my_lookup.csv.

Answer

Creates a lookup definition and automatically populates it with the file contents.

Answer

Adds the file to the monitor directory.

Question 7

Refer to the exhibit. The search returns no results for the 'country' field even though the lookup file exists and contains IP-to-country mappings. Which is the most likely issue?

Accepted Answer

The IP field extracted by rex is in a different format than the lookup key.. The most likely issue is that the IP field extracted by the `rex` command is in a different format than the lookup key (e.g., the lookup expects an integer representation of the IP, or a different subnet notation, or the extracted field contains extra characters like whitespace or quotes). Lookups match based on exact string equality, so any mismatch in format (e.g., '192.168.1.1' vs '192.168.001.001' or '3232235521') will cause zero results, even if the lookup file is correctly configured and contains the mapping.

Answer

The lookup command should be placed before the rex command.

Answer

The country field already exists in the events.

Answer

The lookup file is in the wrong directory.

Question 8

A security analyst runs a search that returns many fields, most of which are not needed. Which command should be used to remove all fields except 'src_ip', 'dest_ip', and 'action'?

Accepted Answer

| fields + src_ip, dest_ip, action. The `fields` command with the `+` prefix explicitly keeps only the listed fields and removes all others from the search results. This is the correct way to retain only `src_ip`, `dest_ip`, and `action` while discarding the rest.

Answer

| rename src_ip as src, dest_ip as dest, action as act

Answer

| fields - src_ip, dest_ip, action

Answer

| table src_ip, dest_ip, action

Question 9

A user creates a CSV lookup file 'users.csv' with columns 'userid' and 'full_name'. A lookup definition is set up. The search `index=auth | lookup users.csv userid AS user OUTPUT full_name` returns no results for 'full_name' even though there are matching userids. What is the most likely cause?

Accepted Answer

The lookup name 'users.csv' should be the lookup definition name, not the filename.. The `lookup` command in Splunk requires the lookup definition name, not the filename, when referencing a lookup table. Even though the CSV file is named 'users.csv', the lookup definition created in Settings > Lookups defines the logical name used in searches. Using the filename directly causes Splunk to fail to resolve the lookup, resulting in no 'full_name' values being returned.

Answer

The search returns no events for the userid field.

Answer

The lookup command should be placed before the index search.

Answer

The 'AS user' should be 'AS userid'.

Question 10

A Splunk admin has a lookup with 10 million rows. The search uses this lookup as a left join and takes too long. Which design change would most improve performance?

Accepted Answer

Filter the main search to only relevant events before the lookup.. Filtering the main search to only relevant events before the lookup reduces the number of rows that need to be matched against the 10-million-row lookup table. This minimizes the computational overhead of the left join operation, as Splunk must compare each event from the main search against every row in the lookup. By narrowing the event set early, you drastically cut the number of comparisons, directly improving search performance.

Answer

Use the 'output' clause to limit returned fields.

Answer

Use an automatic lookup instead of the lookup command.

Answer

Convert the lookup to a KV store collection.

Question 11

A search uses `| fields - _raw, _time` and then later needs `_time` again. What will happen?

Accepted Answer

The `_time` field is no longer available for later commands.. The `| fields - _raw, _time` command explicitly removes the `_time` field from the search results. Once a field is removed using the `fields` command with a minus sign, it is no longer available for any subsequent commands in the search pipeline. This is because the `fields` command operates on the current working set of events, stripping out the specified fields entirely, and later commands cannot reference a field that has been removed.

Answer

The command removes all fields except _raw and _time.

Answer

The command will cause an error because you cannot remove internal fields.

Answer

The `_time` field will still be available but empty.

Question 12

An organization needs to enrich authentication events with employee department information stored in a MySQL database. The data is updated frequently. Which lookup type is most appropriate?

Accepted Answer

External lookup. An external lookup is the most appropriate choice for enriching authentication events with data from a MySQL database that is updated frequently. External lookups can execute a script or command (e.g., Python, Perl) that queries the database on every search, or they can be used with Splunk DB Connect to directly connect to MySQL and retrieve fresh data. Unlike KV Store lookups, which rely on manually populating Splunk's internal store and do not natively connect to external databases, external lookups provide real-time access to the live database. CSV lookups are static and require manual reloading, and geographic lookups are for geospatial data only.

Answer

Geographic lookup

Answer

CSV file lookup

Answer

KV store lookup

Question 13

A time-based lookup is configured with `max_offset_secs = 3600`. An event has a timestamp 100 seconds after the lookup time value. Will the lookup match?

Accepted Answer

Yes, because the offset is within the allowed range.. The time-based lookup is configured with `max_offset_secs = 3600`, which defines the maximum allowed offset (in seconds) between the event timestamp and the lookup time. Since the event timestamp is 100 seconds after the lookup time, the offset is 100 seconds, which is well within the 3600-second window. No `min_offset_secs` is required for this match to succeed, as the default minimum offset is 0 (meaning the event timestamp can be equal to or later than the lookup time).

Answer

Yes, but only if min_offset_secs is also set.

Answer

No, because the event timestamp is later than the lookup time.

Answer

No, because the event timestamp must be before the lookup time.

Question 14

Which command reads a lookup file and outputs it as search results?

Accepted Answer

| inputlookup mylookup.csv. The `| inputlookup mylookup.csv` command reads the specified lookup file (mylookup.csv) from the lookups directory and outputs its contents as search results, making it the correct choice. This command is specifically designed to load a static lookup table into the search pipeline for further processing or inspection.

Answer

| outputlookup mylookup.csv

Answer

| lookup mylookup.csv

Answer

| lookup definition mylookup

Question 15

A search needs to replace a field value 'user' with 'full name' using a CSV lookup that has 'username' and 'fullname' columns. Which lookup command is correct?

Accepted Answer

| lookup users.csv username AS user OUTPUT fullname AS full_name. The `lookup` command syntax requires specifying the lookup file, then the field name in the lookup file (`username`) mapped to the field in the event (`user`) using `AS`, and then `OUTPUT` to bring the `fullname` field into the event as a new field named `full_name`. This matches the requirement to replace the field value 'user' with 'full name' by using the CSV lookup's `fullname` column.

Answer

| lookup users.csv username AS user OUTPUTNEW fullname

Answer

| lookup users.csv user AS username OUTPUT fullname

Answer

| lookup users.csv user AS fullname OUTPUT username