Configure an Automatic Lookup SPLK-1001 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A Splunk admin has multiple sourcetypes sending data: 'apache_access', 'apache_error', and 'nginx_access'. The admin wants to enrich only the 'apache_access' events with a lookup that maps client IPs to geographic locations. How should the automatic lookup be configured?

   • ALeave the sourcetype field blank so the lookup applies to all sourcetypes.
   • BSpecify 'apache_access' as the sourcetype in the automatic lookup configuration.
   • CSpecify 'apache_error' as the sourcetype in the automatic lookup configuration.
   • DSpecify 'nginx_access' as the sourcetype in the automatic lookup configuration.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which search would you run to verify that an automatic lookup is working correctly?

   • AA search for all sourcetypes to see which ones have the lookup applied
   • BA search for events from the target sourcetype, then check if the enriched fields appear in the results
   • CA search using the 'lookup' command without specifying the lookup name
   • DA search for the lookup table file name in the index
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of configuring an automatic lookup in Splunk?

   • ATo permanently modify the raw event data so that external fields become part of the original log
   • BTo create a new index that contains only the lookup table data for faster searching
   • CTo enrich events with fields from an external data source without requiring users to manually invoke the lookup in each search
   • DTo replace the need for field extractions by storing all external data directly in the index
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A Splunk admin needs to enrich firewall logs from a specific source (firewall01) with a lookup that maps IP addresses to asset owners. The lookup file 'asset_owners.csv' has been uploaded to Splunk. What is the next required step before configuring the automatic lookup?

   • ARestart Splunk to make the CSV file available.
   • BCreate a field extraction for the IP address field in the firewall logs.
   • CRun a search to verify the CSV file contains the correct data.
   • DCreate a lookup definition for 'asset_owners.csv'.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   After configuring an automatic lookup to enrich authentication events with employee details, a user runs a search but does not see the expected 'department' field in the results. What is the most likely reason for this?

   • AThe search was run before the automatic lookup was saved.
   • BThe automatic lookup is working but the field is hidden by default in the search results.
   • CThe lookup definition was created but the CSV file was not uploaded.
   • DThe automatic lookup was applied to a different sourcetype than the one being searched.
   Reveal Solution Discussion Select an answer first