SPLK-1001 Using Fields and Lookups Practice Question
Your team uses a large CSV lookup 'users.csv' with 200,000 rows. When running searches that use this lookup via the lookup command, performance is slow. Which action would most improve performance?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add an index to the lookup file by converting to KV Store
To improve performance with a large CSV lookup (200,000 rows), converting it to a KV Store (Option C) is the best choice because KV Store lookups are indexed, making field matching much faster than searching the entire CSV file each time. Option A (external lookup) is wrong because querying a database adds network and database overhead, often slowing performance further. Option B (increasing timeout) does not speed up the lookup; it only prevents timeouts during long operations. Option D (increasing max_matches) controls how many matching results are returned, but does not affect the speed of the lookup operation itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Switch to an external lookup that queries a database
Why it's wrong here
External lookups are generally slower.
- ✗
Increase the lookup timeout value
Why it's wrong here
Timeout is for failure, not performance.
- ✓
Add an index to the lookup file by converting to KV Store
Why this is correct
KV Store allows indexing on fields, speeding up lookups.
- ✗
Increase the max_matches setting for the lookup
Why it's wrong here
max_matches controls number of matches, not speed.
Go deeper
Related to this question
About these practice questions
One of 502 original SPLK-1001 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.