Using Fields and Lookups →hardMultiple ChoiceObjective-mapped

SPLK-1001 Using Fields and Lookups Practice Question

A search using `| lookup user_lookup user_id OUTPUT department_name` returns incorrect department names for some users. The lookup file is correct. What could be the issue?

⚠ Common exam trap

Splunk often tests the subtlety that whitespace in event fields can break lookups, leading candidates to incorrectly blame the lookup file or definition when the actual issue is data cleanliness.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The field `user_id` in the events has trailing spaces.

Trailing spaces in the `user_id` field within the events will cause the lookup to fail to match the corresponding entry in the lookup file, even though the lookup file itself is correct. Splunk performs exact string matching for lookups by default, so any leading or trailing whitespace in the event data will prevent a match, leading to incorrect or missing output. Using the `trim` function or a `| rex` command to strip whitespace before the lookup resolves this issue.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The output field name is misspelled in the search.
Why it's wrong here
Misspelling would yield no output for that field.
✓
The field `user_id` in the events has trailing spaces.
Why this is correct
Trailing spaces cause mismatch.
✗
The lookup file has duplicate entries for the same user_id.
Why it's wrong here
Duplicates would still return a value.
✗
The lookup definition uses case-insensitive matching.
Why it's wrong here
Case-insensitive helps matching.

Visual reference

Go deeper

SPLK-1001 Using Fields and Lookups Practice Question

Why each option matters

Option-by-option breakdown

Related to this question