SPLK-1002 Advanced Visualization and Lookups Practice Question
A security analyst wants to map IP addresses to hostnames using a CSV lookup file. Which command is correct to define a lookup that maps the IP field to hostname field, with the file named 'ip_host.csv'?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
lookup ip_host.csv ip as ip_output hostname as hostname_output
The lookup command syntax for mapping multiple fields is 'lookup <lookup-table> <input-field1> as <output-field1> <input-field2> as <output-field2>'. Here, 'lookup ip_host.csv ip as ip_output hostname as hostname_output' correctly maps the ip field from your data to ip_output in the lookup, and hostname from the lookup to hostname_output. Option A incorrectly uses OUTPUT, which is used for single field output. Option B has reversed order and missing output alias. Option C returns all rows without mapping.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
lookup ip_host.csv hostname OUTPUT ip
Why it's wrong here
OUTPUT keyword used incorrectly; missing output field alias.
- ✗
lookup ip_host.csv hostname as hostname ip as ip_output
Why it's wrong here
Incorrect order; should map input fields first.
- ✗
inputlookup ip_host.csv
Why it's wrong here
inputlookup returns all rows, not a joined result.
- ✓
lookup ip_host.csv ip as ip_output hostname as hostname_output
Why this is correct
Correct syntax for lookup with field mapping.
Go deeper
Related to this question
About these practice questions
This SPLK-1002 question is part of Courseiva's 475-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.