Advanced Visualization and Lookups →mediumMultiple ChoiceObjective-mapped

SPLK-1002 Advanced Visualization and Lookups Practice Question

Exhibit

[mysourcetype]
LOOKUP-geo = geo_lookup src_ip OUTPUTNEW city, country

[geo_lookup]
filename = geo.csv
max_matches = 1
default_match = NotFound
match_type = CIDR(src_ip)

Refer to the exhibit. When a source IP does not match any entry in geo.csv, what values will be added to the event?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

city and country are set to 'NotFound'

The lookup definition in the exhibit sets `default_match='NotFound'`, and `OUTPUTNEW` adds fields only if they are not already present. When no match occurs, the default values 'NotFound' are used for both `city` and `country`. Option A is incorrect because the search does not fail; it continues with the default values. Option B is incorrect because fields are still added with default values. Option C is incorrect because the default_match overrides any default empty string behavior.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The search fails with an error
Why it's wrong here
default_match handles unmatched lookups gracefully.
✗
No fields are added
Why it's wrong here
default_match ensures fields are added with the default value.
✗
city and country are set to empty strings
Why it's wrong here
default_match overrides empty/null with specified value.
✓
city and country are set to 'NotFound'
Why this is correct
default_match defines the fallback value for unmatched fields.

Go deeper

SPLK-1002 Advanced Visualization and Lookups Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question