SPLK-1001 Using Fields and Lookups Practice Question
A large enterprise uses Splunk to monitor network traffic from thousands of devices. The events contain a field 'dest_ip' that you want to enrich with a company-specific asset owner and department. The asset data is stored in an SQL database that is updated daily. The Splunk administrator has set up a DB Connect app to query the database. However, the performance of the search is very slow when using dbquery to lookup asset information for each event. The team needs to improve performance while still maintaining daily updates. Which approach should the team take?
⚠ Common exam trap
Test-takers frequently assume real-time database connectivity (Option D) is always better for freshness, but they overlook the severe performance penalty of per-event database queries in high-volume environments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use DB Connect to export the asset data to a CSV file or KV Store collection on a daily schedule, then use a CSV or KV Store lookup in searches
Exporting the asset data from the SQL database to a CSV file or KV Store collection on a daily schedule leverages the DB Connect app for bulk data transfer rather than per-event queries. This approach avoids the overhead of repeated dbquery calls during search time, which cause performance degradation. Using a CSV or KV Store lookup then provides fast, indexed lookups that can be refreshed daily to maintain data freshness.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a search-time field extraction that parses the dest_ip to derive owner and department
Why it's wrong here
Field extraction cannot derive owner/department from an IP address without external data.
- ✗
Increase the number of indexers to parallelize the lookup operations
Why it's wrong here
Adding indexers does not speed up the lookup itself; the bottleneck is the database query.
- ✓
Use DB Connect to export the asset data to a CSV file or KV Store collection on a daily schedule, then use a CSV or KV Store lookup in searches
Why this is correct
Pre-loading the data into a faster lookup source (CSV or KV Store) eliminates real-time database queries and speeds up searches.
- ✗
Use the 'lookup' command with a KV Store lookup that is populated from the database in real time
Why it's wrong here
Real-time KV Store writes may still be slow and cause latency.
Go deeper
Related to this question
About these practice questions
One of 502 original SPLK-1001 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.