A Splunk admin wants to use a lookup to add a 'priority' field to incidents based on the incident type. The priority values are stored in a CSV file that is updated quarterly. Which lookup type should the admin use?

KV store lookup with real-time updates

Static lookup with automatic refresh

A Splunk user wants to categorize firewall logs into 'Allowed' or 'Blocked' based on the action field, which currently contains values like 'permit' and 'deny'. The user has a CSV file with these mappings. What is the most efficient way to apply this categorization to the events?

Use a field alias to rename the action field

Use a lookup to map the action values to the desired categories

Use a calculated field to replace the action values

Use a regex extraction to parse the action field

Which statement best describes how a lookup is used in a Splunk search?

It is a command that runs automatically on every search without user intervention

It is a saved search that produces a table of results for later use

It is a way to map a field in your events to additional fields from an external source

It is a method to compress event data to reduce storage costs

Which of the following is a common use case for a lookup in Splunk?

Changing the timestamp format of events

Categorizing data into groups, such as mapping IP addresses to departments

Encrypting sensitive fields in event data

Deleting duplicate events from the index

A Splunk admin needs to create a lookup that will be updated frequently by a custom application through Splunk's REST API. The lookup will be used to enrich events with real-time status information. Which lookup type should the admin choose?

KV store lookup with a CSV backup

Static lookup with a scheduled refresh

SplunkCore Certified User

Domain 7Objective 1

Describe Lookups SPLK-1001 Practice Questions (Page 1)

Part of the Creating and Using Lookups domain, which accounts for 6% of the SPLK-1001 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~2–2 in this domain), expect 1–1 from this objective — we provide 20 practice questions to prepare you well beyond it. (estimate)

20questions here

4free pages

4concepts

6%of the exam

Questions 1–5

1application · medium
A Splunk admin wants to use a lookup to add a 'priority' field to incidents based on the incident type. The priority values are stored in a CSV file that is updated quarterly. Which lookup type should the admin use?
Select an answer first
2application · medium
A Splunk user wants to categorize firewall logs into 'Allowed' or 'Blocked' based on the action field, which currently contains values like 'permit' and 'deny'. The user has a CSV file with these mappings. What is the most efficient way to apply this categorization to the events?
Select an answer first
3foundation · easy
Which statement best describes how a lookup is used in a Splunk search?
Select an answer first
4foundation · easy
Which of the following is a common use case for a lookup in Splunk?
Select an answer first
5application · medium
A Splunk admin needs to create a lookup that will be updated frequently by a custom application through Splunk's REST API. The lookup will be used to enrich events with real-time status information. Which lookup type should the admin choose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1001” is a trademark of its owner, used for identification only.