Configure an Automatic Lookup SPLK-1001 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A Splunk admin is troubleshooting an automatic lookup that is not enriching events. The admin has verified that the lookup definition exists and the CSV file is present. The automatic lookup is configured with the correct sourcetype and field mappings. What is the next most likely thing to check?

   • AVerify that the input field in the events matches the lookup key field in the CSV.
   • BConfirm that the CSV file is in the correct index.
   • CCheck if the automatic lookup is applied at index time.
   • DEnsure that the lookup definition has the correct permissions.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the role of a lookup definition in the automatic lookup configuration process?

   • AIt creates a new index for the lookup table data
   • BIt stores the raw event data that will be enriched
   • CIt defines the mapping between fields in the lookup table and fields in the event data
   • DIt determines which users can view the enriched fields
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A Splunk user is configuring an automatic lookup for the first time. They have created a lookup definition called 'device_info' that maps device IDs to device names and locations. In the automatic lookup configuration, what must the user specify to ensure the correct fields are added to the events?

   • AThe input field (device ID) and the output fields (device name, location).
   • BOnly the lookup definition name; the fields are automatically detected.
   • CThe output field (device ID) and the input fields (device name, location).
   • DThe sourcetype and the lookup definition name, but not the fields.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A Splunk admin is considering using an automatic lookup to enrich firewall logs with asset ownership data. The admin has the asset data in a CSV file. What is the primary advantage of using an automatic lookup over having users manually run a lookup command in each search?

   • AUsers do not need to remember to include the lookup command in their searches.
   • BThe automatic lookup can be used without creating a lookup definition.
   • CThe automatic lookup is applied at index time, making searches faster.
   • DThe CSV file is indexed and searchable as events.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   When configuring an automatic lookup in Splunk Web, what must you specify in addition to selecting the lookup definition?

   • AThe user roles that can see the enriched fields
   • BThe index where the lookup table should be stored
   • CThe fields in the lookup table that should be added to events
   • DThe time range for which the lookup should apply
   Reveal Solution Discussion Select an answer first