Referencing Lookups in Alerts core-certified-advanced-power-user Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An alert that uses a lookup to enrich results with a `team` field is failing with the error 'Lookup table 'team_lookup' does not exist.' The lookup definition `team_lookup` was created in the app `my_app`. The alert is running in the app `search`. What is the most likely cause of this error?

   • AThe lookup file is missing from the `my_app` directory.
   • BThe lookup definition is not accessible from the `search` app because it was created in a different app and the permissions are not set to global.
   • CThe alert search is using the wrong syntax for the lookup command.
   • DThe lookup definition name is case-sensitive and the alert is using the wrong case.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A scheduled alert that uses a lookup to enrich results with a `priority` field has been failing intermittently. The alert search is: `index=main | lookup priority_lookup host OUTPUT priority | where priority="high"`. The lookup definition `priority_lookup` is configured with a max matches of 1. Some hosts appear multiple times in the lookup file with different priorities. What is the most likely cause of the intermittent failures?

   • AThe lookup definition is not being refreshed, so it is using stale data.
   • BThe lookup is returning multiple matches for some hosts, and with max matches set to 1, Splunk may return an error or an arbitrary match, causing inconsistent results.
   • CThe lookup file is too large and is timing out during the alert run.
   • DThe `where priority="high"` command is case-sensitive and the lookup returns `High` instead of `high`.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A user reports that a scheduled alert stopped working after a recent change. The alert search includes a `lookup` command that references a lookup definition named `device_registry`. The lookup definition was recently edited to change the field name `device_id` to `device_name` in the underlying CSV file. The alert search still uses `device_id` in the lookup command. What is the most likely cause of the alert failure?

   • AThe lookup command is failing because the field `device_id` no longer exists in the lookup file, causing a 'field not found' error.
   • BThe alert is failing because the lookup definition name `device_registry` is case-sensitive and was changed during the edit.
   • CThe alert is failing because the lookup command requires the `OUTPUT` clause to be specified, and it was removed during the edit.
   • DThe alert is failing because the lookup file is now too large and exceeds the maximum file size for lookups.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   When a lookup in an alert action fails because a field in the alert results does not exist in the lookup, what is the typical outcome?

   • AThe alert action sends an email with the error
   • BThe alert action stops and an error is logged
   • CThe lookup file is automatically updated with the new field
   • DThe alert action continues but the lookup returns no matches for that field
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In Splunk, where is a lookup definition typically created so that it can be referenced in alert actions?

   • AIn the alert action's settings, as an inline lookup table
   • BIn the search head's authentication.conf file
   • CIn Settings > Lookups, as a lookup definition that specifies the lookup file and fields
   • DIn the alert's saved search SPL, using the `lookup` command with a file path
   Reveal Solution Discussion Select an answer first