SPLK-1001 Using Fields and Lookups Practice Question
A Splunk user needs to perform a lookup that matches events based on a field 'userid' to a lookup table that contains 'userid', 'full_name', and 'email'. The lookup table is a CSV file named 'users.csv' located in the default lookup directory. The user runs the search: index=main | lookup users.csv userid OUTPUT full_name, email. However, the search returns an error that the lookup table 'users.csv' was not found. What is the most likely reason for this error?
⚠ Common exam trap
Candidates often assume the `lookup` command can directly use a CSV filename, confusing it with the `inputlookup` command which does accept filenames, while `lookup` strictly requires a definition name.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The lookup command must reference the lookup definition name, not the CSV file name directly
The `lookup` command in Splunk requires a lookup definition name, not the raw CSV filename. The lookup definition is created in Splunk's configuration (e.g., transforms.conf) and maps a logical name to the actual CSV file. Using the filename directly bypasses this definition, causing Splunk to report the file as not found because it searches for a definition, not the file path.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The CSV file must have a .csv extension, but the command should omit the extension
Why it's wrong here
The extension is fine, but the command still needs a definition.
- ✗
The fields 'full_name' and 'email' are not present in the CSV file
Why it's wrong here
Assuming they are present, the error states the table was not found, not missing fields.
- ✗
The CSV file is not in the correct format; it should have a header row
Why it's wrong here
Even if the format is correct, the missing definition is the issue.
- ✓
The lookup command must reference the lookup definition name, not the CSV file name directly
Why this is correct
Splunk requires a lookup definition to be created that points to the CSV file; then you use the definition name in the lookup command.
Go deeper
Related to this question
About these practice questions
This SPLK-1001 question is part of Courseiva's 502-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.