SPLK-5001 SPL Search Proficiency Practice Question
You need to append the contents of a lookup file 'threat_intel.csv' to your search results based on the field 'src_ip'. Which command is correct?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
index=firewall | lookup threat_intel.csv src_ip OUTPUTNEW severity, threat_type
The lookup command is designed to enrich events with data from a lookup file.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
index=firewall | enrich src_ip threat_intel.csv
Why it's wrong here
Enrich is not a valid Splunk command.
- ✓
index=firewall | lookup threat_intel.csv src_ip OUTPUTNEW severity, threat_type
Why this is correct
The lookup command adds fields from the CSV to existing events based on a common field.
- ✗
index=firewall | join src_ip [inputlookup threat_intel.csv]
Why it's wrong here
Join is generally less performant than lookup for simple enrichment.
- ✗
index=firewall | inputlookup threat_intel.csv src_ip
Why it's wrong here
Inputlookup retrieves data from the file, it does not join it to the current search pipeline.
- ✗
index=firewall | append threat_intel.csv
Why it's wrong here
Append requires a search sub-command, not a file path.
About these practice questions
Courseiva writes every SPLK-5001 question from scratch — 203 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Splunk exam blueprint
This SPLK-5001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-5001 exam.