SPLK-1001 Using Fields and Lookups Practice Test 8 — 15 Questions

Question 1

When using an automatic lookup in props.conf, which setting controls the order in which multiple automatic lookups apply to the same sourcetype?

Accepted Answer

The numeric suffix after LOOKUP- in props.conf. In Splunk, when multiple automatic lookups are defined for the same sourcetype in props.conf, the order of execution is determined by the numeric suffix appended to the LOOKUP- stanza (e.g., LOOKUP-1, LOOKUP-2). Splunk processes these lookups in ascending numeric order, ensuring a predictable sequence. This allows administrators to chain lookups where the output of one lookup can feed into the next.

Answer

The order in which they are listed in transforms.conf

Answer

The `batch_index_query` setting

Answer

The `priority` field in the lookup definition

Question 2

Which TWO of the following are best practices for managing lookup files in Splunk?

Accepted Answer

Store the lookup file in $SPLUNK_HOME/etc/system/lookups or an app's lookups directory.. The correct best practices are B and E. Place lookup files in $SPLUNK_HOME/etc/system/lookups or an app's lookups directory (B) to ensure they are properly recognized by Splunk. Always include a header row in CSV lookups (E) to map fields correctly. Option A is wrong because $SPLUNK_HOME/var/run is for runtime data, not permanent lookups. Option C is wrong because global lookups are not a built-in concept; sharing across apps is done via app-level configurations. Option D is wrong because Windows-style CRLF line endings can cause parsing issues in Splunk; Unix-style LF is recommended.

Answer

Place lookup files in $SPLUNK_HOME/var/run to avoid permission issues.

Answer

Use global lookups to share across all apps.

Answer

Use Windows-style CRLF line endings for cross-platform compatibility.

Question 3

Which TWO of the following commands can be used to view the current fields in a search result?

Accepted Answer

| fields. The `| fields` command is used to keep or remove specific fields from search results, effectively showing you the current fields that exist in the result set. The `| fieldsummary` command produces a statistical summary of all fields present in the search results, including count, distinct count, and other metrics, thereby also allowing you to view the current fields.

Answer

| outputlookup mylookup.csv

Answer

| inputlookup mylookup.csv

Answer

| listfields

Question 4

Which THREE of the following are true about automatic field extraction in Splunk?

Accepted Answer

It can extract fields from structured data like JSON and XML.. Splunk's automatic field extraction (also known as 'auto kv' or 'key-value extraction') can parse structured data formats such as JSON and XML. When Splunk indexes data, it automatically identifies key-value pairs in these formats and extracts them as searchable fields without requiring manual configuration.

Answer

Custom field extractions are not allowed if auto extraction is enabled.

Answer

Auto extraction cannot be disabled for specific sourcetypes.

Question 5

A large enterprise uses Splunk across 50 indexers and a search head cluster. An analyst reports that a search using a lookup file 'employees.csv' (500 MB, 10 million rows) is extremely slow. The search is: `index=winlogs sourcetype=Security EventCode=4624 | lookup employees.csv account AS User OUTPUT department, manager`. The lookup currently runs on each event, and the entire CSV is loaded into memory on the search head each time. There are about 5 million matching events per day. The company has a separate Identity Management system that updates employee data hourly. The analyst needs the lookup to be fast and up-to-date. Which solution should the Splunk admin implement?

Accepted Answer

Convert the lookup to a KV store collection and use the lookup as a key-value store.. Converting the large, frequently updated CSV lookup to a KV store collection allows Splunk to index the data and perform key-value lookups efficiently without loading the entire file into memory on the search head. The KV store supports real-time updates from the Identity Management system via REST API, ensuring the lookup remains up-to-date while drastically improving search performance for 5 million daily events across 50 indexers.

Answer

Use a static CSV but compress it and use `lookup` command with `| makeresults` approach.

Answer

Increase the `max_mem_usage` setting for the lookup in limits.conf.

Answer

Add a time range early in the search to reduce events.

Question 6

A Splunk admin configured a CSV-based lookup to map device IP addresses to location data. The lookup 'devices.csv' has columns 'ip', 'building', 'floor'. In props.conf, they set: `LOOKUP-1 = devices ip OUTPUT building floor`. In transforms.conf: `[devices] filename = devices.csv`. The search over sourcetype 'network_logs' returns events with the 'ip' field, but 'building' and 'floor' are missing. The admin confirms the CSV file exists and has data. What is the most likely issue?

Accepted Answer

The props.conf LOOKUP-1 syntax is incorrect; the definition should be `LOOKUP-1 = devices` only, and the match/output fields should be defined in transforms.conf.. The `LOOKUP-1` definition in `props.conf` incorrectly includes the match and output fields. The correct syntax is `LOOKUP-1 = devices` only, with the match field (`ip`) and output fields (`building`, `floor`) defined in the `transforms.conf` stanza under `[devices]` using `external_type = csv`, `filename = devices.csv`, `match_type = WILDCARD(ip)`, and `default_match = NONE`. The admin's syntax causes Splunk to ignore the lookup configuration entirely, so no fields are added.

Answer

The CSV file is too large and the lookup is not being loaded.

Answer

The 'ip' field is not properly extracted from the sourcetype.

Answer

The lookup file is not accessible from the search head because it is stored on a different host.

Question 7

A security analyst needs to enrich firewall logs with user identity information stored in a CSV file. The CSV file contains fields: user_id, username, department, location. The firewall logs contain a field 'src_user_id'. Which Splunk feature should be used to add the username and department fields to the firewall events based on matching src_user_id to user_id?

Accepted Answer

Define a lookup table from the CSV file and use the input lookup command or automatic lookup to add username and department. A lookup table defined from the CSV file allows Splunk to map the 'src_user_id' field in firewall events to the 'user_id' field in the CSV, then add the 'username' and 'department' fields from the lookup. This is the standard method for enriching events with external data using the 'inputlookup' command or an automatic lookup configuration.

Answer

Create a field alias that maps src_user_id to username and department

Answer

Use the eval command with an if statement to populate username and department from src_user_id

Answer

Create a calculated field that computes username and department based on src_user_id

Question 8

A Splunk administrator notices that a lookup definition named 'assets' is not returning any results in searches even though the CSV file exists and has data. The lookup definition uses the filename 'assets.csv' and the matching field 'ip' matches the event field 'dest_ip'. The search query 'index=main | lookup assets ip AS dest_ip OUTPUT asset_name' returns no asset_name values. What is the most likely cause?

Accepted Answer

The user may not have permissions to access the lookup definition; check the knowledge object permissions. The lookup definition exists and the CSV file has data, but the search returns no results, indicating a permissions issue. In Splunk, knowledge objects like lookups have permissions that restrict which roles can use them; if the user's role lacks read access to the 'assets' lookup definition, the lookup command will silently return no results. The syntax and command structure are otherwise correct, so the most likely cause is that the lookup definition's permissions are not set to allow the user's role.

Answer

The lookup command syntax is incorrect; it should be 'lookup assets dest_ip AS ip'

Answer

The lookup command is missing the 'name' field; it should be 'lookup assets name AS ip'

Answer

The command should use 'inputlookup' instead of 'lookup' to load the CSV data

Question 9

A Splunk user wants to create a lookup that maps a field 'status_code' to a human-readable 'status_description'. The lookup data is small and changes infrequently. Which TWO methods are appropriate for creating this lookup? (Choose two.)

Accepted Answer

Create a lookup definition file (transforms.conf) with the mapping inline. A lookup definition file (transforms.conf) can contain an inline mapping using the `filename` or `external_type` settings, but more specifically for small static data, you can define a lookup with a `table` or `static` definition that directly maps values without an external file. This is efficient for small, infrequently changing data as it avoids file management overhead. Option E is correct because saving a CSV file with the mapping and defining a lookup from that file is the standard method for small, static lookup data in Splunk, using the `lookup` command or automatic lookup to enrich events.

Answer

Create a KV Store collection to store the mapping

Answer

Use the 'lookup' command in a search to create a temporary mapping each time

Answer

Use a calculated field in props.conf to derive the description from the code

Question 10

A Splunk administrator is troubleshooting a time-based lookup that is supposed to match events to a lookup table that changes over time. The lookup is defined with time_field 'start_time' and time_format '%Y-%m-%d %H:%M:%S'. Which THREE conditions must be met for the time-based lookup to correctly match an event to a single row in the lookup table? (Choose three.)

Accepted Answer

The lookup definition must specify the time format used in the time_field column. The lookup definition must specify the time format used in the time_field column so that Splunk can correctly parse the time values in the lookup table. Without this format specification, Splunk cannot interpret the timestamps and the time-based matching will fail.

Answer

The lookup table must have exactly one row per unique time value

Answer

The lookup must be defined as an automatic lookup in props.conf

Question 11

A large enterprise uses Splunk to monitor network traffic from thousands of devices. The events contain a field 'dest_ip' that you want to enrich with a company-specific asset owner and department. The asset data is stored in an SQL database that is updated daily. The Splunk administrator has set up a DB Connect app to query the database. However, the performance of the search is very slow when using dbquery to lookup asset information for each event. The team needs to improve performance while still maintaining daily updates. Which approach should the team take?

Accepted Answer

Use DB Connect to export the asset data to a CSV file or KV Store collection on a daily schedule, then use a CSV or KV Store lookup in searches. Exporting the asset data from the SQL database to a CSV file or KV Store collection on a daily schedule leverages the DB Connect app for bulk data transfer rather than per-event queries. This approach avoids the overhead of repeated dbquery calls during search time, which cause performance degradation. Using a CSV or KV Store lookup then provides fast, indexed lookups that can be refreshed daily to maintain data freshness.

Answer

Create a search-time field extraction that parses the dest_ip to derive owner and department

Answer

Increase the number of indexers to parallelize the lookup operations

Answer

Use the 'lookup' command with a KV Store lookup that is populated from the database in real time

Question 12

A Splunk user needs to perform a lookup that matches events based on a field 'userid' to a lookup table that contains 'userid', 'full_name', and 'email'. The lookup table is a CSV file named 'users.csv' located in the default lookup directory. The user runs the search: index=main | lookup users.csv userid OUTPUT full_name, email. However, the search returns an error that the lookup table 'users.csv' was not found. What is the most likely reason for this error?

Accepted Answer

The lookup command must reference the lookup definition name, not the CSV file name directly. The `lookup` command in Splunk requires a lookup definition name, not the raw CSV filename. The lookup definition is created in Splunk's configuration (e.g., transforms.conf) and maps a logical name to the actual CSV file. Using the filename directly bypasses this definition, causing Splunk to report the file as not found because it searches for a definition, not the file path.

Answer

The CSV file must have a .csv extension, but the command should omit the extension

Answer

The fields 'full_name' and 'email' are not present in the CSV file

Answer

The CSV file is not in the correct format; it should have a header row

Question 13

A company uses Splunk to monitor web server logs. They have a lookup table that maps IP addresses to geographic locations (city, country). The lookup is defined as a CSV file with fields: ip, city, country. The lookup definition is named 'geo'. The team wants to automatically add city and country to every web event at index time, so that all future searches have this enrichment without adding the lookup command. The team tries to set up an automatic lookup in props.conf for the sourcetype 'web_access', but the city and country fields still do not appear in the events. They verify that the lookup file exists and that the lookup definition works when used manually with the lookup command. What is the most likely cause of the automatic lookup not working?

Accepted Answer

The automatic lookup definition in props.conf is not correctly configured for the intended sourcetype. The automatic lookup definition in props.conf must be correctly configured for the intended sourcetype. The most common misconfiguration is specifying the wrong sourcetype or incorrect syntax in the TRANSFORMS directive, which prevents the lookup from being applied at index time. Since the lookup works manually, the issue is with the props.conf configuration, not the lookup file or definition itself.

Answer

Index-time lookups are not supported; enrichment can only be done at search time

Answer

The lookup file must be in KV Store format for index-time lookups

Answer

The lookup must be invoked with the 'lookup' command in the search to populate the fields

Question 14

A Splunk user wants to see a list of all fields that are extracted from events of sourcetype 'apache_access'. They need to know which fields are available for use in searches and lookups. Which command should they use to discover all fields automatically extracted by Splunk for that sourcetype?

Accepted Answer

Use the search 'sourcetype=apache_access | fields' to list all fields in a few sample events. The `| fields` command, when used without arguments, lists all fields present in the search results. By searching `sourcetype=apache_access` and piping to `| fields`, Splunk returns a table of all extracted fields (both default and custom) from the events of that sourcetype, allowing the user to see which fields are available for searches and lookups.

Answer

Use the 'extract' command with no arguments to show all extracted fields

Answer

Use the 'regex' command with a capturing group to identify fields

Answer

Use the 'inputlookup' command to display field names

Question 15

A Splunk administrator needs to create a field alias that renames the field 'src_ip' to 'source_ip' for events in the index 'network'. The administrator has created the field alias in the Field Aliases settings in the UI. However, when searching index=network, the new field 'source_ip' does not appear in the events. The search still shows 'src_ip'. What could be the reason?

Accepted Answer

The field alias is configured for a specific sourcetype that does not match the events in the index. Field aliases in Splunk are configured per sourcetype. If the alias is applied to a sourcetype that does not match the events in the 'network' index, the alias will not take effect, and the original field name 'src_ip' will continue to appear. The administrator must ensure the alias is assigned to the correct sourcetype(s) present in the index.

Answer

Field aliases only work with lookups, not with standard fields

Answer

The field 'src_ip' is not extracted automatically; an explicit field extraction is required first

Answer

The alias should be created using the 'rename' command in the search, not via the UI