SPLK-1001 Using Fields and Lookups Practice Question
An organization needs to enrich authentication events with employee department information stored in a MySQL database. The data is updated frequently. Which lookup type is most appropriate?
⚠ Common exam trap
Test-takers frequently choose CSV file lookup (Option C) because it is the simplest and most familiar lookup type, failing to recognize that it cannot handle frequently updated data without manual reloading or scheduled scripts, whereas the KV Store is designed for dynamic, real-time updates.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
External lookup
An external lookup is the most appropriate choice for enriching authentication events with data from a MySQL database that is updated frequently. External lookups can execute a script or command (e.g., Python, Perl) that queries the database on every search, or they can be used with Splunk DB Connect to directly connect to MySQL and retrieve fresh data. Unlike KV Store lookups, which rely on manually populating Splunk's internal store and do not natively connect to external databases, external lookups provide real-time access to the live database. CSV lookups are static and require manual reloading, and geographic lookups are for geospatial data only.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
External lookup
Why this is correct
Correct. External lookups can run scripts or use DB Connect to query a MySQL database at search time, making them ideal for frequently updated data from an external data source.
- ✗
Geographic lookup
Why it's wrong here
Incorrect. Geographic lookups are used for mapping geographic coordinates or CIDR to locations, not for connecting to a MySQL database.
- ✗
CSV file lookup
Why it's wrong here
Incorrect. CSV file lookups are static files that must be manually reloaded or updated via a scheduled script; they are not suitable for frequently updated data from a live database.
- ✗
KV store lookup
Why it's wrong here
A KV store lookup is inappropriate because the employee department information resides in a MySQL database and is frequently updated. Utilising a KV store would necessitate replicating this dynamic data, introducing latency and potential data staleness between MySQL and the KV store, failing to meet the requirement for current information. This scenario requires a direct lookup mechanism that queries the live source. KV stores are designed for extremely fast retrieval of static or pre-indexed data, making them tempting for performance-critical lookups where data synchronisation isn't a primary concern or updates are infrequent.
Go deeper
Related to this question
About these practice questions
One of 502 original SPLK-1001 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.