SPLK-1002 Advanced Visualization and Lookups Practice Question
A large lookup file with 10 million rows is used in a search that joins with main index data. The search is slow. Which optimization should be applied first?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Convert the lookup to a KV store collection.
Converting a large lookup to a KV store collection significantly improves performance by enabling indexed lookups, reducing the time needed for join operations. Option A is incorrect because 'lookup local=true' only controls where the lookup file is searched (local versus peers), not its performance. Option B is incorrect because adding a filter using a subsearch adds overhead and is not an optimization; it can make the search slower. Option D is incorrect because 'inputlookup' loads the entire lookup into memory, which for 10 million rows would be slow and memory-intensive, not a performance improvement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use 'lookup local=true' to reduce time.
Why it's wrong here
local=true is for distributed search, not performance.
- ✗
Add a filter on the lookup using a subsearch.
Why it's wrong here
Subsearch adds complexity and may not reduce load.
- ✓
Convert the lookup to a KV store collection.
Why this is correct
KV store is optimized for large datasets and lookups.
- ✗
Use 'inputlookup' instead of 'lookup'.
Why it's wrong here
inputlookup loads entire file, causing more overhead.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1002 question from scratch — 475 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.