How should I use these Using Fields and Lookups practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Using Fields and Lookups questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Using Fields and Lookups domain.

SPLK-1001 · topic practice

Using Fields and Lookups practice questions

Practise Splunk Core Certified User SPLK-1002 Using Fields and Lookups practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Using Fields and Lookups

Practice 10 questions Browse domain →

What the exam tests

What to know about Using Fields and Lookups

Using Fields and Lookups questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Using Fields and Lookups exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Using Fields and Lookups questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Using Fields and Lookups explanation →

A lookup table contains employee names and IDs. An admin wants to add the employee name to events that contain an employee ID field called 'emp_id'. What is the correct lookup command syntax?

Trap 1: | lookup employee_lookup employee_name FROM emp_id

This syntax is incorrect because FROM is not a valid clause in the lookup command. The correct format is `| lookup lookup-table field-to-match OUTPUT fields-to-add`.

Trap 2: | lookup employee_lookup emp_id OUTPUTNEW *

This command would add all fields from the lookup table as new fields. While it would add the employee name, it also adds any other fields, which may not be desired. The question specifically asks to add only the employee name, so this is not the most precise answer.

Trap 3: | lookup employee_lookup emp_id OUTPUT employee_name

This uses OUTPUT instead of OUTPUTNEW. OUTPUT will overwrite any existing field named employee_name in the event, whereas OUTPUTNEW adds the field only if it does not already exist. Since the requirement is to add the name without overwriting, OUTPUTNEW is the correct choice.

Study all Using Fields and Lookups common traps →

A
| lookup employee_lookup employee_name FROM emp_id
Why wrong: This syntax is incorrect because FROM is not a valid clause in the lookup command. The correct format is `| lookup lookup-table field-to-match OUTPUT fields-to-add`.
B
| lookup employee_lookup emp_id OUTPUTNEW *
Why wrong: This command would add all fields from the lookup table as new fields. While it would add the employee name, it also adds any other fields, which may not be desired. The question specifically asks to add only the employee name, so this is not the most precise answer.
C
| lookup employee_lookup emp_id OUTPUT employee_name
Why wrong: This uses OUTPUT instead of OUTPUTNEW. OUTPUT will overwrite any existing field named employee_name in the event, whereas OUTPUTNEW adds the field only if it does not already exist. Since the requirement is to add the name without overwriting, OUTPUTNEW is the correct choice.
D
| lookup employee_lookup emp_id OUTPUTNEW employee_name
This is correct because it adds the employee_name field as a new field, ensuring no existing data is overwritten.

Using Fields and Lookups practice questions

What to know about Using Fields and Lookups

Common Using Fields and Lookups exam traps

Using Fields and Lookups questions

A lookup table contains employee names and IDs. An admin wants to add the employee name to events that contain an employee ID field called 'emp_id'. What is the correct lookup command syntax?

An analyst runs a search and needs to view only events where the 'status' field has a value of 'failed'. Which command should be used?

A user runs a search for errors but notices that the `source` field is not appearing in the selected fields list. What is the most likely reason?

An administrator wants to add a lookup table that maps user IDs to department names. The lookup file is a CSV with columns `user_id` and `department`. To use this lookup in searches, what must be configured?

An analyst wants to automatically look up a field 'user_id' in a lookup file every time a search is run, without having to type the lookup command manually. Which approach is best?

Which TWO of the following must be true for the lookup to return results?

Exhibit

A security analyst is investigating a suspicious IP address. They want to find all events related to that IP. Which field should they use in a search?

A Splunk admin wants to enrich web server logs with geographic location data based on IP addresses. Which approach should they use?

A search returns many events but the 'status' field is missing from some events. The admin wants to set a default value of 'unknown' when the field is absent. Which command should be used?

A user wants to see only events where the 'action' field has a value of 'success'. Which search syntax should they use?

A search includes a lookup that returns multiple values per event. The admin wants to see each matched value as a separate event. Which command should be used after the lookup?

In Splunk, which of the following is true about fields?

An admin notices that a lookup is not returning any results for some events even though matching keys exist. What is the most likely cause?

A search uses a lookup that returns a field 'priority'. The admin wants to use the lookup only for events where the 'source' is 'firewall'. Which command should be used?

Which of the following best describes the purpose of the 'fields' command in a search?

A user wants to create a field that contains the length of the 'message' field. Which command should they use?

Which TWO of the following are valid ways to extract fields in Splunk? (Choose two.)

Which THREE of the following are true about lookups in Splunk? (Choose three.)

A Splunk admin wants to handle missing field values in a search. Which TWO SPL options can replace null values with a specified default? (Choose two.)

Which THREE statements about the 'rex' command are correct? (Choose three.)

Track your progress over time

Start a Using Fields and Lookups only practice session

Related SPLK-1001 topic practice pages

Splunk Basics and Interface Navigation practice questions

Basic Searching and Transforming Commands practice questions

Using Fields and Lookups practice questions

Creating Reports, Dashboards and Visualizations practice questions

SPLK-1001 fundamentals practice questions

SPLK-1001 scenario practice questions

SPLK-1001 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid