Courseiva

SPLK-1001

Study mode — explanations shown

1

Using Fields and Lookups

easy

Refer to the exhibit. An analyst runs the search and expects the `country`, `region`, and `city` fields to appear in the results, but they do not. What is the most likely reason?

Exhibit

Refer to the exhibit.

search command: `index=web sourcetype=access | lookup geo_ip.csv clientip OUTPUT country region city`

Exhibit shows the first few lines of the geo_ip.csv file:

clientip,country,region,city
10.0.0.1,USA,CA,San Francisco
10.0.0.2,USA,NY,New York
10.0.0.3,CAN,ON,Toronto
0 of 65 answered