SPLK-1001 Using Fields and Lookups Practice Question
A Splunk admin configured a CSV-based lookup to map device IP addresses to location data. The lookup 'devices.csv' has columns 'ip', 'building', 'floor'. In props.conf, they set: `LOOKUP-1 = devices ip OUTPUT building floor`. In transforms.conf: `[devices] filename = devices.csv`. The search over sourcetype 'network_logs' returns events with the 'ip' field, but 'building' and 'floor' are missing. The admin confirms the CSV file exists and has data. What is the most likely issue?
⚠ Common exam trap
A common mix-up: candidates confuse the `props.conf` LOOKUP syntax with the `| lookup` SPL command, mistakenly thinking match and output fields can be specified inline in `props.conf`.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The props.conf LOOKUP-1 syntax is incorrect; the definition should be `LOOKUP-1 = devices` only, and the match/output fields should be defined in transforms.conf.
The `LOOKUP-1` definition in `props.conf` incorrectly includes the match and output fields. The correct syntax is `LOOKUP-1 = devices` only, with the match field (`ip`) and output fields (`building`, `floor`) defined in the `transforms.conf` stanza under `[devices]` using `external_type = csv`, `filename = devices.csv`, `match_type = WILDCARD(ip)`, and `default_match = NONE`. The admin's syntax causes Splunk to ignore the lookup configuration entirely, so no fields are added.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The props.conf LOOKUP-1 syntax is incorrect; the definition should be `LOOKUP-1 = devices` only, and the match/output fields should be defined in transforms.conf.
Why this is correct
In props.conf, after LOOKUP-<class> = you just specify the lookup name; field mappings go in transforms.conf under that stanza.
- ✗
The CSV file is too large and the lookup is not being loaded.
Why it's wrong here
Size doesn't prevent loading; it might be slow but would still populate fields.
- ✗
The 'ip' field is not properly extracted from the sourcetype.
Why it's wrong here
The problem states events have the 'ip' field.
- ✗
The lookup file is not accessible from the search head because it is stored on a different host.
Why it's wrong here
If the search head is not the indexer, the lookup must be on the search head or in a shared location.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1001 question from scratch — 502 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.