SPLK-1001 Using Fields and Lookups Practice Question
A user has a lookup file containing employee email addresses and department names. They want to add the department field to search results containing the employee's email. Which command should they use?
⚠ Common exam trap
Watch out — candidates often confuse `inputlookup` (which reads the file as events) with `lookup` (which enriches existing events), leading them to choose option A when they need field enrichment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
lookup employee_department.csv email OUTPUT department
The `lookup` command is designed to enrich search results by matching a field in the events (e.g., email) against a lookup table (e.g., employee_department.csv) and outputting additional fields (e.g., department). Option B correctly uses the syntax `lookup employee_department.csv email OUTPUT department`, which performs a field-based lookup and appends the department field to matching events.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
inputlookup employee_department.csv
Why it's wrong here
Inputlookup returns all rows from the lookup, it doesn't enrich search results.
- ✓
lookup employee_department.csv email OUTPUT department
Why this is correct
Lookup joins on the email field and outputs the department field into search results.
- ✗
eval department=employee_department(email)
Why it's wrong here
Eval cannot access lookup files directly without the lookup function.
- ✗
outputlookup employee_department.csv
Why it's wrong here
Outputlookup writes results to a lookup file, not used for enrichment.
Go deeper
Related to this question
About these practice questions
One of 502 original SPLK-1001 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.