Lookups And Alerts

A compliance officer needs an alert that runs a saved search every day at 06:00 and emails a report of all privileged account creations found in the previous 24 hours, regardless of how many events are returned. Which trigger configuration accomplishes this?

Which action can be triggered by a Splunk alert?

You are building a dashboard panel that must display the top 10 source IP addresses by count of failed logins, and the results must be returned as a single results set with a field named 'fail_count'. You also need to add a drilldown that passes the selected source IP to another dashboard. Which search command sequence correctly produces the required results set while keeping the field name 'fail_count'?

You are using an automatic lookup. If you want to overwrite an existing field in your search results with a value from the lookup, which setting should be enabled?

You are configuring a lookup definition named `product_owner` that uses a CSV file. The lookup contains a field `product_id` that in your event data is sometimes lowercase and sometimes uppercase. You need the lookup to match regardless of case. Which advanced setting in the lookup definition should you configure?

You are using the lookup command to enrich your search results with a CSV lookup. You want to add a field from the lookup only if that field does not already exist in your events. Which argument should you use?

Which search command is used to display the contents of a lookup table?

Where is the most appropriate place to check for errors related to a failed lookup execution?

When configuring a CSV lookup file, where is the file uploaded in Splunk?

What is the result of setting an alert's priority to 'High'?

An analyst is building an alert that must fire only when the count of events from a search exceeds a threshold, and the alert must suppress duplicate notifications for the same host for one hour. The search is `index=firewall action=blocked | stats count by src_ip`. Which TWO alert configuration elements are required to satisfy these requirements? (Choose two.)

You are configuring a new alert in Splunk to trigger when a search returns more than 10 failed login attempts. You want the alert to send an email and also run a script. Which two actions must you configure in the alert definition? (Choose two.)

Which THREE settings can be configured for a scheduled alert?

Which TWO of the following are required components to successfully implement a CSV-based automatic lookup?

You have an automatic lookup that enriches events with `user_department` from a CSV file. You run a search and notice that the `user_department` field is not appearing in the results, even though the lookup file contains the correct mappings and the automatic lookup is enabled. Which of the following is the most likely cause?

A Splunk administrator uploads a new CSV lookup file containing a column of IPv4 addresses in CIDR notation. Analysts need searches to match individual event IPs against these ranges rather than requiring exact string equality. Which lookup definition setting must be configured?

An analyst uses the following search to enrich events: index=web | lookup local=1 web_assets clientip OUTPUTNEW asset_owner, asset_criticality. They notice that events where clientip matches multiple entries in web_assets get an arbitrary owner value. They need deterministic behavior where the first matching entry in the lookup is used. Which approach should they take?

What is the primary purpose of a lookup?

You need to create a lookup that will be updated frequently with new data from a search. Which lookup type should you use to allow for fast, concurrent writes and reads?

You are configuring a new alert in Splunk Enterprise Security. You want to ensure that the alert triggers only when a specific condition is met and that it performs multiple actions. Which two alert settings are required to define the alert's trigger condition and actions? (Choose two.)

A user wants to restrict an alert to trigger only once per hour, even if the search returns results every minute. Which setting should be modified?

You have a scheduled alert that runs every hour and triggers when the number of results is greater than 0. The alert is configured to send an email. You notice that the alert triggers and sends an email every hour, even when there are no new events. The search itself returns results because it includes a `stats` command that always returns at least one row (e.g., a count of 0). How can you modify the alert to only trigger when there are actual events?

A security team wants to trigger an alert when a user account is locked out more than five times in 10 minutes. They create a saved search with the following SPL: index=security EventCode=4740 | stats count by user | where count > 5. They configure the alert to run every 10 minutes and trigger when the number of results is greater than 0. Which alert action should they configure to automatically create a ticket in their incident management system?

You need to update a lookup table periodically using the output of a scheduled search. Which command is required to write the search results to the lookup file?

You want an alert to run every Monday at 8 AM. How should you configure the schedule?

Which of the following is a key advantage of using KV Store lookups over CSV lookups?

You maintain a KV Store lookup named asset_inventory in the search app. A scheduled search populates it every 15 minutes. A dashboard user reports that when they run a search that joins against asset_inventory, some events return no lookup fields, even though the assets exist in the collection. You confirm the lookup definition is shared globally and the collection contains the expected keys. Which action should you take to ensure the lookup is usable by the dashboard user's searches without granting them write access to the collection?

You need to ensure that an alert does not fire multiple times for the same user if they trigger the alert 50 times in one minute. Which throttling setting should you use?

A Splunk administrator is designing a lookup that will be used in a real-time alert to enrich incoming events with user department information. The lookup must support rapid updates without restarting Splunk, allow multiple users to modify entries concurrently, and provide the ability to define a lookup with a case-sensitive match. The administrator wants to use a KV Store lookup instead of a CSV lookup. Which two statements accurately describe KV Store lookups in this context? (Choose two.)

You have configured an automatic lookup that is failing to populate. You verified the lookup definition and the automatic lookup rule. What is the most likely reason for the failure?

What is the result of using 'OUTPUTNEW' instead of 'OUTPUT' in a lookup command?

A Splunk power user is configuring an alert that must trigger only when a search returns more than 100 events in a 5-minute window. The user wants to avoid duplicate alerts for the same set of events and wants the alert to include a link to the search results in the notification email. Which alert configuration should the user set to prevent duplicate alerts?

You have a lookup definition 'user_info' that maps user to department. In a search, you run: index=main | lookup user_info user OUTPUTNEW department AS dept. Some events already contain a field named 'dept'. What is the result for those events?

You need to create a lookup definition that references a CSV file stored in the `lookups` directory of your app. Which configuration file is used to define the lookup?

You have a lookup definition named `employee_lookup` that maps `employee_id` to `department` and `manager`. You want to use this lookup in a search to add the `department` and `manager` fields to your events, but you also want to ensure that if the `department` field already exists in the event, it is not overwritten. Which `lookup` command syntax achieves this?

Which TWO settings in a lookup definition affect how the lookup matches the data?

You need to ensure that an alert notifies a specific team via email only when the number of errors exceeds 50 in 5 minutes. What is the correct way to implement this?

You have a CSV lookup file 'employees.csv' with fields employee_id, department, and manager. You need to enrich incoming events that contain 'user' by matching user to employee_id and adding department and manager to the events. The lookup should apply automatically to all searches against the 'main' index without requiring users to add a lookup command. What should you configure?

Which permission setting is required for other users to use a lookup table you have created?

Which TWO of the following are valid lookup types in Splunk?

You have an alert that runs a search every 15 minutes and triggers when the number of failed login attempts exceeds 10. The alert is configured to send an email. After a week, you notice that the alert triggered multiple times but no emails were received. You verify the search returns results and the email settings are correct. What is the most likely cause?

Which TWO pieces of information must be provided when defining a lookup table file upload?