What indicates that an automatic lookup has successfully enriched an event?

The event contains fields from the lookup table that were not originally in the raw data

The event's raw text has been modified to include the lookup data

The event's timestamp has been updated to the lookup time

The event has been moved to a different index

A Splunk admin has an automatic lookup that enriches 'apache_access' events with a 'geo_location' field. The admin now wants to apply the same lookup to 'nginx_access' events without affecting other sourcetypes. The admin also wants to minimize the number of configurations to maintain. What is the best approach?

Edit the existing automatic lookup and change the sourcetype to 'nginx_access'.

Edit the existing automatic lookup and leave the sourcetype blank to apply to all sourcetypes.

Create a second automatic lookup for 'nginx_access' using the same lookup definition.

Modify the lookup definition to include a new field for 'nginx_access'.

A Splunk user has configured an automatic lookup to enrich payment transactions with customer names. After running a search, the user does not see the 'customer_name' field in the results. What is the first thing the user should check?

Ensure that the search is using the correct time range.

Confirm that the lookup definition was created with the correct file name.

Check if the CSV file has been deleted from the filesystem.

Verify that the automatic lookup is applied to the correct sourcetype.

In Splunk Web, which sequence of steps correctly creates an automatic lookup?

Settings > Lookups > Automatic lookups > New, then select a lookup definition and specify the fields to match

Settings > Lookups > Lookup definitions > New, then choose 'Automatic' as the type

Search app > Lookups > New Automatic Lookup, then type the lookup table name manually

Settings > Fields > Automatic lookups > New, then upload a CSV file directly

A Splunk admin is comparing automatic lookups with manual lookup commands for enriching security events. The team has a strict requirement that all security analysts must see the enriched fields without having to modify their searches. Which approach best meets this requirement?

Manual lookup command, because it gives users control over the enrichment.

Automatic lookup, but only if applied at index time.

Automatic lookup, because it enriches events automatically for all users.

Manual lookup command, because it is faster than an automatic lookup.

SplunkCore Certified User

Domain 7Objective 4

Configure an Automatic Lookup SPLK-1001 Practice Questions (Page 2)

Part of the Creating and Using Lookups domain, which accounts for 6% of the SPLK-1001 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~2–2 in this domain), expect 1–1 from this objective — we provide 20 practice questions to prepare you well beyond it. (estimate)

20questions here

4free pages

5concepts

6%of the exam

Questions 6–10

6foundation · easy
What indicates that an automatic lookup has successfully enriched an event?
Select an answer first
7expert · hard
A Splunk admin has an automatic lookup that enriches 'apache_access' events with a 'geo_location' field. The admin now wants to apply the same lookup to 'nginx_access' events without affecting other sourcetypes. The admin also wants to minimize the number of configurations to maintain. What is the best approach?
Select an answer first
8application · medium
A Splunk user has configured an automatic lookup to enrich payment transactions with customer names. After running a search, the user does not see the 'customer_name' field in the results. What is the first thing the user should check?
Select an answer first
9foundation · easy
In Splunk Web, which sequence of steps correctly creates an automatic lookup?
Select an answer first
10expert · hard
A Splunk admin is comparing automatic lookups with manual lookup commands for enriching security events. The team has a strict requirement that all security analysts must see the enriched fields without having to modify their searches. Which approach best meets this requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1001” is a trademark of its owner, used for identification only.