SPLK-1002 Advanced Visualization and Lookups Practice Question
A company needs to enrich search results with additional fields from a CSV file. Which method should they use to define the lookup table so that it is available in all searches?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Define the lookup in transforms.conf with a filename and field mapping.
To make a lookup table available in all searches, the lookup definition must be created in transforms.conf. This file defines the lookup table filename, field mapping, and other properties. Once defined, the lookup can be used with the lookup command, the inputlookup command, or automatic lookups configured in props.conf. Option C correctly identifies this requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Define the lookup in props.conf with an automatic lookup stanza.
Why it's wrong here
Defining a lookup in props.conf with an automatic lookup stanza is for enabling automatic lookups, but the lookup table itself must first be defined in transforms.conf.
- ✗
Use the inputlookup command in a search.
Why it's wrong here
The inputlookup command reads a lookup table and loads it into search results, but it does not define the lookup; the lookup must already be defined in transforms.conf.
- ✓
Define the lookup in transforms.conf with a filename and field mapping.
Why this is correct
Correct. The lookup table file and format must be defined in transforms.conf with a filename and field mapping to be available for use in searches.
- ✗
Use the lookup command with the file path.
Why it's wrong here
Using the lookup command with a file path is not valid; the lookup command requires a lookup name that has been defined in transforms.conf.
- ✗
Use the eval command with the lookup function directly in search.
Why it's wrong here
The eval command with the lookup function also requires a predefined lookup definition in transforms.conf; it does not directly access a file.
Go deeper
Related to this question
About these practice questions
One of 475 original SPLK-1002 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.