Using Fields and Lookups →hardMultiple ChoiceObjective-mapped

SPLK-1001 Using Fields and Lookups Practice Question

Exhibit

| inputlookup usertable
| where role="admin"
| stats count by department

Refer to the exhibit. The lookup `usertable` has fields: user, role, department. The search returns an error: "Error in 'where' command: Field 'role' is not defined." What is the most likely cause?

⚠ Common exam trap

Candidates often confuse lookup definition errors (e.g., missing lookup file) with field-level errors (e.g., missing column) and might incorrectly blame the inputlookup command or reserved words instead of checking the actual lookup file schema.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The lookup file does not have a column named 'role'.

The error 'Field ''role'' is not defined' in the `where` command indicates that the field 'role' does not exist in the events being processed. Since the `inputlookup` command loads the lookup file into the search pipeline, the most likely cause is that the lookup file does not contain a column named 'role'. Option D correctly identifies this root cause.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The `inputlookup` command does not output fields that can be used with `where`.
Why it's wrong here
It does output fields.
✗
The field 'role' is not a valid field in the lookup because it is a reserved word.
Why it's wrong here
'role' is not reserved.
✗
The lookup name 'usertable' is misspelled.
Why it's wrong here
Would give file not found.
✓
The lookup file does not have a column named 'role'.
Why this is correct
Field undefined.

Go deeper

SPLK-1001 Using Fields and Lookups Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question