Advanced Visualization and Lookups →mediumMultiple ChoiceObjective-mapped

SPLK-1002 Advanced Visualization and Lookups Practice Question

Exhibit

Refer to the exhibit.
props.conf stanza:
[mysourcetype]
LOOKUP-custom = my_lookup OUTPUTNEW field1 field2

transforms.conf stanza:
[my_lookup]
filename = my_lookup.csv
match_type = WILDCARD(field1)

An admin configured an automatic lookup but events for mysourcetype are not being enriched. What is the most likely problem?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The match_type should be 'EXACT' instead of 'WILDCARD'.

The WILDCARD match_type requires the event value to contain wildcard characters or be matched glob-style; typical exact matches require EXACT match_type. Option C is possible but the syntax can omit INPUT if the field names match. Options A and D are less likely.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The lookup file is too large and memory limit is exceeded.
Why it's wrong here
Would produce errors, not silent failure.
✓
The match_type should be 'EXACT' instead of 'WILDCARD'.
Why this is correct
For direct field matching, EXACT is appropriate; WILDCARD is for pattern matching.
✗
The LOOKUP stanza in props.conf is missing the input field specification.
Why it's wrong here
If the input field name matches the lookup field, it can be omitted; that is not necessarily the issue.
✗
The lookup is defined in transforms.conf but not referenced in any search.
Why it's wrong here
It is referenced in props.conf, so it is used automatically.

Go deeper

SPLK-1002 Advanced Visualization and Lookups Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question