20+ practice questions focused on Using Fields and Lookups — one of the most tested topics on the Splunk Core Certified User SPLK-1002 exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Using Fields and Lookups PracticeA lookup table contains employee names and IDs. An admin wants to add the employee name to events that contain an employee ID field called 'emp_id'. What is the correct lookup command syntax?
Explanation: The `OUTPUTNEW` clause in a lookup command only adds fields from the lookup table that are not already present in the event, preventing overwriting of existing field values. In this scenario, the admin wants to add the employee name to events that already contain an `emp_id` field, so `OUTPUTNEW employee_name` ensures the name is appended without modifying any existing data.
An analyst runs a search and needs to view only events where the 'status' field has a value of 'failed'. Which command should be used?
Explanation: The `where` command in Splunk allows you to filter events based on a field value using a comparison expression. In this case, `where status = "failed"` evaluates each event and retains only those where the `status` field exactly matches the string "failed". This is the appropriate command when you need to filter results after the initial search has already been run, or when you need to use comparison operators that are not available in the `search` command.
A user runs a search for errors but notices that the `source` field is not appearing in the selected fields list. What is the most likely reason?
Explanation: Although the user reports that the `source` field is not appearing in the selected fields list, the `source` field is indeed a default metadata field in Splunk that is automatically extracted at index time for every event. It is always present in the event data. The selected fields list only displays fields that the user has specifically chosen to show; if `source` is not visible there, it simply means the user has not added it to the selected fields. However, the field itself is always available. Therefore, the most likely reason the user does not see it in the list is that they have not selected it, but the field remains present in all events.
An administrator wants to add a lookup table that maps user IDs to department names. The lookup file is a CSV with columns `user_id` and `department`. To use this lookup in searches, what must be configured?
Explanation: To use a static CSV lookup in Splunk, you must upload the file to the lookups directory, then define a lookup stanza in transforms.conf specifying the filename and field mapping (e.g., `[users_lookup] filename = users.csv`). Optionally, you can create a lookup definition in props.conf for automatic field enrichment, but the lookup can be used manually via the `lookup` or `inputlookup` commands with just the transforms.conf entry. The key is that configuring both transforms.conf (mandatory) and props.conf (for automatic lookup) is the standard approach to fully integrate the lookup.
An analyst wants to automatically look up a field 'user_id' in a lookup file every time a search is run, without having to type the lookup command manually. Which approach is best?
Explanation: Automatic lookups are configured under Settings > Lookups > Automatic lookups. You define a lookup definition and then apply it to a specific source type or index, which causes the lookup to run automatically on every search matching that source type or index without requiring the manual `lookup` command. This is the intended method for automatic lookups in Splunk.
+15 more Using Fields and Lookups questions available
Practice all Using Fields and Lookups questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Using Fields and Lookups. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Using Fields and Lookups questions on the SPLK-1001 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Using Fields and Lookups is tested as part of the Splunk Core Certified User SPLK-1002 blueprint. Practicing with targeted Using Fields and Lookups questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free SPLK-1001 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Using Fields and Lookups is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Using Fields and Lookups practice session with instant scoring and detailed explanations.
Start Using Fields and Lookups Practice →