Create a Lookup File and Create a Lookup Definition SPLK-1001 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An admin is creating a lookup file from a CSV that contains a column with leading zeros, such as '00123'. The admin wants to preserve these leading zeros when the lookup is used. What should the admin do?

   • AConvert the column to a number in the CSV file.
   • BEnsure the CSV file is saved with the column formatted as text.
   • CUse a lookup definition to add leading zeros back.
   • DUpload the file as a TSV to preserve formatting.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An admin is creating a CSV lookup file from an export of a database table. The export includes a column named 'Last Name' with a space in the header. The admin wants to use this field in Splunk searches. What should the admin do to ensure the field name is usable?

   • AConvert the CSV to a JSON format to avoid header issues.
   • BUpload the file as-is and reference the field as 'Last Name' in searches.
   • CCreate a lookup definition that renames the field during import.
   • DRename the column header to 'last_name' in the CSV file before uploading.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A Splunk admin has uploaded a CSV file and created a lookup definition. The admin wants to verify that the lookup definition is correctly configured by viewing the data it contains. Which command should the admin use?

   • A| inputlookup <lookup_name>
   • B| outputlookup <lookup_name>
   • C| search <lookup_name>
   • D| lookup <lookup_name>
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A Splunk admin has created a lookup definition for a CSV file that maps product codes to product names. The admin wants to use this lookup in a search to replace the product code with the product name. What is the correct approach?

   • AUse the 'replace' command with the lookup definition.
   • BUse the 'lookup' command with the OUTPUT clause to add the product name as a new field.
   • CUse the 'inputlookup' command to replace the field.
   • DUse the 'eval' command with the lookup definition.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An admin is creating a lookup file from a CSV that contains a column with dates in the format 'MM/DD/YYYY'. The admin wants to use this field in searches. What should the admin do to ensure the dates are usable in Splunk?

   • AConvert the dates to epoch time in the CSV file.
   • BChange the date format to 'YYYY-MM-DD' in the CSV file.
   • CRemove the dates from the CSV file.
   • DKeep the dates as strings in the CSV file.
   Reveal Solution Discussion Select an answer first