SPLK-1001 Using Fields and Lookups Practice Question
A company uses Splunk to monitor web server logs. They have a lookup table that maps IP addresses to geographic locations (city, country). The lookup is defined as a CSV file with fields: ip, city, country. The lookup definition is named 'geo'. The team wants to automatically add city and country to every web event at index time, so that all future searches have this enrichment without adding the lookup command. The team tries to set up an automatic lookup in props.conf for the sourcetype 'web_access', but the city and country fields still do not appear in the events. They verify that the lookup file exists and that the lookup definition works when used manually with the lookup command. What is the most likely cause of the automatic lookup not working?
⚠ Common exam trap
Watch out — candidates often assume automatic lookups work identically to search-time lookups, but they require explicit configuration in props.conf and transforms.conf, and any syntax error or sourcetype mismatch will silently fail.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The automatic lookup definition in props.conf is not correctly configured for the intended sourcetype
The automatic lookup definition in props.conf must be correctly configured for the intended sourcetype. The most common misconfiguration is specifying the wrong sourcetype or incorrect syntax in the TRANSFORMS directive, which prevents the lookup from being applied at index time. Since the lookup works manually, the issue is with the props.conf configuration, not the lookup file or definition itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Index-time lookups are not supported; enrichment can only be done at search time
Why it's wrong here
Splunk does support index-time lookups via automatic lookups in props.conf, though search-time is more common.
- ✗
The lookup file must be in KV Store format for index-time lookups
Why it's wrong here
CSV files are acceptable for index-time lookups.
- ✗
The lookup must be invoked with the 'lookup' command in the search to populate the fields
Why it's wrong here
Automatic lookups are designed to work without explicit commands.
- ✓
The automatic lookup definition in props.conf is not correctly configured for the intended sourcetype
Why this is correct
If the props.conf stanza does not match the sourcetype, the lookup will not be applied.
Go deeper
Related to this question
About these practice questions
One of 502 original SPLK-1001 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.