Configure an Automatic Lookup SPLK-1001 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   How can you restrict an automatic lookup so it only applies to events from a specific sourcetype?

   • ABy adding a filter in the lookup table file
   • BBy specifying the sourcetype in the automatic lookup configuration
   • CBy creating a separate index for that sourcetype
   • DBy using a saved search to apply the lookup only to certain events
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which two items must exist before you can configure an automatic lookup in Splunk Web?

   • AA saved search and a data model
   • BA knowledge object permission and a role
   • CAn index and a sourcetype
   • DA lookup table file and a lookup definition
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst frequently runs a search for authentication events and manually joins the results with a CSV file containing employee department and manager information. The analyst wants to eliminate this manual step so that every authentication event is automatically enriched with the employee details whenever the search is run. What should the analyst do?

   • ACreate a lookup definition for the CSV file, then configure an automatic lookup that maps the employee ID field from the events to the lookup and apply it to the authentication sourcetype.
   • BUse the 'inputlookup' command in the search to manually join the CSV data each time the search is run.
   • CUpload the CSV file to Splunk and it will automatically enrich all events without any additional configuration.
   • DCreate an automatic lookup that directly references the CSV file path without first creating a lookup definition.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A Splunk admin is explaining to a new team member why automatic lookups are beneficial for their environment. The team frequently runs searches on firewall logs and needs to see the asset owner for each IP address. Which statement accurately describes the primary benefit of using an automatic lookup for this scenario?

   • AIt speeds up the search by pre-computing the asset owner for every event.
   • BIt reduces the storage size of the firewall logs by removing the IP address field.
   • CIt replaces the need for field extractions on the firewall logs.
   • DIt enriches firewall events with asset owner information automatically, so users do not need to manually join the data in each search.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A Splunk admin has configured an automatic lookup to enrich web logs with user details. The lookup works for most events, but some events are not being enriched. The admin suspects the issue is with the input field matching. What is the most likely cause of the partial enrichment?

   • AThe lookup definition is missing the output fields.
   • BSome events have a user ID that does not exist in the lookup table.
   • CThe automatic lookup is applied at index time for some events.
   • DThe sourcetype field in the automatic lookup is case-sensitive.
   Reveal Solution Discussion Select an answer first