Using Fields and Lookups →mediumMultiple ChoiceObjective-mapped

SPLK-1001 Using Fields and Lookups Practice Question

Exhibit

[excel_lookup]
filename = sales_data.csv
max_matches = 1
default_match = N/A
case_sensitive_match = true

Refer to the exhibit. A user runs a search with `| lookup excel_lookup product_id OUTPUT sales_rep`. For a product_id that exists in the CSV but with a different case (e.g., "ABC123" vs "abc123"), what will be the value of the `sales_rep` field after the lookup?

⚠ Common exam trap

A common pitfall in Splunk is assuming the `| lookup` command is case-insensitive. Additionally, candidates often forget that if a `default_match` value is configured, it will be returned instead of an empty string or error when no match is found.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

"N/A" because the case does not match and default_match is set.

The `| lookup` command in Splunk is case-sensitive by default. When the product_id in the event has a different case than the lookup file, the lookup fails to find a match. If the lookup definition has `default_match` set to a value like 'N/A', that default value is returned for the `sales_rep` field instead of the actual lookup value.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The correct sales_rep from the lookup.
Why it's wrong here
Case mismatch prevents match.
✗
An error because case mismatch.
Why it's wrong here
No error.
✓
"N/A" because the case does not match and default_match is set.
Why this is correct
default_match is used.
✗
An empty string because no match.
Why it's wrong here
default_match is set.

Go deeper

SPLK-1001 Using Fields and Lookups Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question