SPLK-1002 Advanced Visualization and Lookups Practice Question
An organization uses Splunk to monitor network traffic. They have a CIDR lookup file that maps IP ranges to departments. When they run a search using `| lookup cidr_lookup IP OUTPUT department`, some IP addresses do not return a department even though the IPs are within the defined ranges. What is the most likely issue?
⚠ Common exam trap
Test-takers frequently assume a lookup file with CIDR ranges will automatically work for IP matching, but Splunk requires an explicit configuration change to enable CIDR-based matching instead of exact string matching.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The lookup definition is not configured as a CIDR type
The most likely issue is that the lookup definition is not configured as a CIDR type. In Splunk, a standard lookup performs exact string matching, so it will not correctly match an IP address against a range defined in a CIDR notation (e.g., 10.0.0.0/24). To enable range-based matching, the lookup definition must be explicitly set to 'CIDR' type in transforms.conf, which allows Splunk to evaluate whether the IP falls within the specified subnet. Without this configuration, the lookup will fail to return a department for IPs that are within the defined ranges.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The lookup definition is not configured as a CIDR type
Why this is correct
CIDR lookups must be defined with type=cidr in transforms.conf.
- ✗
The IP addresses in the events are in lowercase
Why it's wrong here
IPs are case-insensitive.
- ✗
The lookup file is not in CSV format
Why it's wrong here
CSV is the standard format for CIDR lookups.
- ✗
The lookup file is compressed and not being read correctly
Why it's wrong here
Compressed lookups are supported but not the issue.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1002 question from scratch — 475 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.