SPLK-1001 Using Fields and Lookups Practice Question
A Splunk administrator notices that a lookup definition named 'assets' is not returning any results in searches even though the CSV file exists and has data. The lookup definition uses the filename 'assets.csv' and the matching field 'ip' matches the event field 'dest_ip'. The search query 'index=main | lookup assets ip AS dest_ip OUTPUT asset_name' returns no asset_name values. What is the most likely cause?
⚠ Common exam trap
Candidates often assume the issue is a syntax error or incorrect field mapping, but Splunk tests the understanding that lookup permissions can silently block results even when the CSV file and definition are correctly configured.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user may not have permissions to access the lookup definition; check the knowledge object permissions
The lookup definition exists and the CSV file has data, but the search returns no results, indicating a permissions issue. In Splunk, knowledge objects like lookups have permissions that restrict which roles can use them; if the user's role lacks read access to the 'assets' lookup definition, the lookup command will silently return no results. The syntax and command structure are otherwise correct, so the most likely cause is that the lookup definition's permissions are not set to allow the user's role.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The lookup command syntax is incorrect; it should be 'lookup assets dest_ip AS ip'
Why it's wrong here
The syntax 'ip AS dest_ip' is correct: it matches the lookup field 'ip' to the event field 'dest_ip'.
- ✗
The lookup command is missing the 'name' field; it should be 'lookup assets name AS ip'
Why it's wrong here
The field name used in the lookup must match the actual field in the lookup file, which is 'ip' not 'name'.
- ✓
The user may not have permissions to access the lookup definition; check the knowledge object permissions
Why this is correct
If the user does not have read access to the lookup definition, the lookup will silently return no results.
- ✗
The command should use 'inputlookup' instead of 'lookup' to load the CSV data
Why it's wrong here
inputlookup is used to search the lookup table directly, not to enrich events. The lookup command is appropriate here.
Go deeper
Related to this question
About these practice questions
This SPLK-1001 question is part of Courseiva's 502-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.