A Splunk administrator has uploaded a CSV file named 'products.csv' to the lookups directory of an app. What must the administrator do to make this file available as a lookup in searches?

Set the file permissions to 'readable' for all users in the app.

Create a lookup definition that references the file and specifies the fields to use.

Use the 'inputlookup' command with the file name to load it into the search.

Rename the file to 'lookup.csv' and place it in the default app directory.

When creating a lookup definition in Splunk, which of the following must be specified?

The permissions for the lookup and the app context in which it will be used.

The file path to the lookup file and the time range for which the lookup is valid.

The file format (CSV, KV Store) and the default value to return if no match is found.

The name of the lookup file and the fields that will be used for input and output.

A security analyst wants to enrich firewall logs with a department name for each internal IP address. The analyst has a spreadsheet with columns 'ip_address' and 'department'. The spreadsheet contains a header row and 500 rows of data. The analyst exports it as a CSV file. What must the analyst do before this file can be used as a lookup in Splunk?

Upload the CSV file to Splunk via Settings > Lookups > Lookup table files.

Convert the CSV file to a TSV format before uploading.

Rename the file extension to .lookup before uploading.

Create a lookup definition first, then upload the file.

A Splunk admin has a CSV lookup file that maps user IDs to full names. The admin creates a lookup definition and wants to ensure that events without a matching user ID still show a 'full_name' field with a value of 'Unknown'. What should the admin configure in the lookup definition?

Add a row to the CSV with 'Unknown' as the user ID.

Enable 'Advanced options' and set 'Filter' to 'Unknown'.

Set a default value for the 'full_name' field.

Set the lookup type to 'KV Store'.

An admin is creating a lookup file from a CSV that contains a column with values that include leading and trailing spaces, such as ' 123 '. The admin wants to ensure that these spaces do not cause issues in searches. What should the admin do?

Use a lookup definition to trim the spaces.

Convert the CSV to a TSV file to avoid spaces.

Upload the file as-is and use the 'trim' command in searches.

Trim the spaces from the values in the CSV file before uploading.

SplunkCore Certified User

Domain 7Objective 3

Create a Lookup File and Create a Lookup Definition SPLK-1001 Practice Questions (Page 1)

Part of the Creating and Using Lookups domain, which accounts for 6% of the SPLK-1001 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~2–2 in this domain), expect 1–1 from this objective — we provide 10 practice questions to prepare you well beyond it. (estimate)

10questions here

2free pages

2concepts

6%of the exam

Questions 1–5

1foundation · easy
A Splunk administrator has uploaded a CSV file named 'products.csv' to the lookups directory of an app. What must the administrator do to make this file available as a lookup in searches?
Select an answer first
2foundation · easy
When creating a lookup definition in Splunk, which of the following must be specified?
Select an answer first
3application · medium
A security analyst wants to enrich firewall logs with a department name for each internal IP address. The analyst has a spreadsheet with columns 'ip_address' and 'department'. The spreadsheet contains a header row and 500 rows of data. The analyst exports it as a CSV file. What must the analyst do before this file can be used as a lookup in Splunk?
Select an answer first
4application · medium
A Splunk admin has a CSV lookup file that maps user IDs to full names. The admin creates a lookup definition and wants to ensure that events without a matching user ID still show a 'full_name' field with a value of 'Unknown'. What should the admin configure in the lookup definition?
Select an answer first
5application · medium
An admin is creating a lookup file from a CSV that contains a column with values that include leading and trailing spaces, such as ' 123 '. The admin wants to ensure that these spaces do not cause issues in searches. What should the admin do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1001” is a trademark of its owner, used for identification only.