SPLK-1001 Using Fields and Lookups Practice Question
Exhibit
Refer to the exhibit. search command: `index=web sourcetype=access | lookup geo_ip.csv clientip OUTPUT country region city` Exhibit shows the first few lines of the geo_ip.csv file: clientip,country,region,city 10.0.0.1,USA,CA,San Francisco 10.0.0.2,USA,NY,New York 10.0.0.3,CAN,ON,Toronto
Refer to the exhibit. An analyst runs the search and expects the `country`, `region`, and `city` fields to appear in the results, but they do not. What is the most likely reason?
⚠ Common exam trap
Splunk often tests the distinction between uploading a lookup file and defining it as a lookup, tricking candidates into thinking the file's mere presence is sufficient for the `lookup` command to work.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The lookup file is not defined as a lookup in Splunk's lookups definitions.
Splunk requires a lookup file to be explicitly defined in Settings > Lookups > Lookup definitions before it can be used in a search. Without this definition, the `lookup` command will not find the file, and no fields will be added to the results, even if the file exists on disk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The fields in the lookup must have different names than the output fields.
Why it's wrong here
Field names can match; that is fine.
- ✗
The clientip field in the events has a different data type than the lookup.
Why it's wrong here
Data type mismatch would cause partial issues, but not complete failure.
- ✗
The lookup command should use OUTPUTNEW instead of OUTPUT.
Why it's wrong here
OUTPUTNEW is not a valid option; the correct parameter is OUTPUT.
- ✓
The lookup file is not defined as a lookup in Splunk's lookups definitions.
Why this is correct
Lookup files must be uploaded and defined in Settings > Lookups before they can be used.
Go deeper
Related to this question
About these practice questions
One of 502 original SPLK-1001 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.