SPLK-1001 Using Fields and Lookups Practice Question
A company has a Splunk environment indexing firewall logs from multiple vendors. The security team wants to enrich events with a threat intelligence lookup that contains IP addresses and threat categories. The lookup file 'threat_intel.csv' has fields: ip, category, confidence. The admin runs the following search: index=firewall | lookup threat_intel.csv src_ip OUTPUT category confidence. However, the lookup returns no results, even though there are matching IPs. The admin verifies that the lookup file is uploaded and the field names are correct. What is the most likely cause? The admin suspects that the lookup is case-sensitive, but the IP addresses in the logs are lowercase and the lookup has uppercase. The admin also considers that the lookup might be configured with the wrong field order, or that the lookup command is missing the OUTPUTNEW option, or that the index name is wrong. Which course of action should the admin take first to resolve the issue?
⚠ Common exam trap
Candidates often assume the lookup command syntax is wrong (e.g., field order or OUTPUT vs OUTPUTNEW) when the real issue is a subtle default behavior like case sensitivity, which Splunk explicitly tests in the SPLK-1002 exam.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the lookup definition to set case_sensitive_match = false
The most likely cause is that the lookup is case-sensitive by default, and the IP addresses in the logs are lowercase while the lookup file contains uppercase IPs. Setting `case_sensitive_match = false` in the lookup definition forces Splunk to ignore case when matching, which resolves the issue without altering the data or command structure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Modify the lookup definition to set case_sensitive_match = false
Why this is correct
This allows case-insensitive matching.
- ✗
Swap the field order in the lookup command
Why it's wrong here
Field order does not matter.
- ✗
Change OUTPUT to OUTPUTNEW to avoid overwriting fields
Why it's wrong here
Output options do not affect matching.
- ✗
Change the index to default
Why it's wrong here
Index is correct.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1001 question from scratch — 502 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.