SPLK-1001 Using Fields and Lookups Practice Question
An analyst needs to create a lookup file. Which TWO methods can be used?
⚠ Common exam trap
Splunk often tests the distinction between commands that create lookup files (`outputlookup`) versus commands that only export data as CSV (`outputcsv`), trapping candidates who assume any CSV export creates a usable lookup.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Upload a CSV file via the Lookups UI.
The Lookups UI in Splunk Web provides a direct method to upload a CSV file and create a lookup table file (static lookup) without needing to write any commands. Option E is correct because the `outputlookup` command writes the results of a search directly into a lookup file, creating or appending to a lookup definition. Both are standard methods for creating lookup files in Splunk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use inputlookup command.
Why it's wrong here
inputlookup reads a lookup, does not create one.
- ✗
Use rex to parse and then outputcsv.
Why it's wrong here
outputcsv creates a downloadable CSV, not a system lookup.
- ✓
Upload a CSV file via the Lookups UI.
Why this is correct
Direct upload via UI creates a lookup definition.
- ✗
Use eval to create a table and then export.
Why it's wrong here
eval alone does not create a persistent file.
- ✓
Use outputlookup command.
Why this is correct
Creates a lookup CSV in the lookups directory.
Go deeper
Related to this question
About these practice questions
One of 502 original SPLK-1001 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.