SPLK-1001 Using Fields and Lookups Practice Question
A Splunk administrator is troubleshooting a time-based lookup that is supposed to match events to a lookup table that changes over time. The lookup is defined with time_field 'start_time' and time_format '%Y-%m-%d %H:%M:%S'. Which THREE conditions must be met for the time-based lookup to correctly match an event to a single row in the lookup table? (Choose three.)
⚠ Common exam trap
Test-takers frequently think a time-based lookup requires exactly one row per time value (Option A) or that it must be defined as an automatic lookup (Option B), but the core requirements are the time format specification, the time range containment, and the single-row match constraint.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The lookup definition must specify the time format used in the time_field column
The lookup definition must specify the time format used in the time_field column so that Splunk can correctly parse the time values in the lookup table. Without this format specification, Splunk cannot interpret the timestamps and the time-based matching will fail.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The lookup table must have exactly one row per unique time value
Why it's wrong here
Multiple rows may have the same time value, but only one should match the event's time range for a proper match.
- ✗
The lookup must be defined as an automatic lookup in props.conf
Why it's wrong here
Automatic lookups are optional; you can use the lookup command in searches.
- ✓
The lookup definition must specify the time format used in the time_field column
Why this is correct
The time_format must match the format in the lookup file for correct parsing.
- ✓
The event's timestamp (or a specified time field) must fall between the start_time and the end_time of a row
Why this is correct
Time-based lookups match if the event time is within the row's time range.
- ✓
The event must match at most one row in the lookup table for the given time range
Why this is correct
If multiple rows match, the behavior is undefined; the lookup should be designed to yield a single match.
Go deeper
Related to this question
About these practice questions
This SPLK-1001 question is part of Courseiva's 502-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.