A Splunk user needs to create a lookup that can be updated by multiple users simultaneously and will be used to enrich events with user roles. The lookup must support real-time updates. Which lookup type should the user choose?

KV store lookup with a CSV export

Static lookup with a scheduled refresh

A Splunk user wants to enrich web server logs with the country of origin based on the client IP address. The user has a CSV file with IP ranges and country names. What is the best way to achieve this?

Use a lookup to map IP ranges to countries

Use a regex extraction to parse the IP address

Use a field alias to rename the IP field

Use a calculated field to derive the country from the IP

A Splunk admin is considering using a KV store lookup for a use case where the data is updated by multiple applications in real-time. However, the admin is concerned about the complexity of managing the KV store. What is the primary advantage of using a KV store lookup over a static CSV lookup in this scenario?

It does not require any configuration

It supports real-time updates from multiple sources

It is easier to manage than a static CSV lookup

It is automatically distributed to all search heads

What is a key difference between a static lookup and a dynamic lookup in Splunk?

Static lookups are file-based, while dynamic lookups use the KV store

Static lookups can be updated via search commands, while dynamic lookups require manual file editing

Static lookups are faster than dynamic lookups

Dynamic lookups are only available in the cloud, while static lookups are on-premises

A Splunk admin is asked to enrich events with a 'business_unit' field based on the user's email domain. The mapping is stored in a CSV file. The admin wants to ensure that the lookup is applied automatically to all searches without requiring users to manually invoke it. What should the admin do?

Configure the lookup as an automatic lookup in the app's props.conf

Create a saved search that applies the lookup and schedules it to run frequently

Use a field alias to automatically map the email domain to the business unit

Use a calculated field to derive the business unit from the email domain

SplunkCore Certified User

Domain 7Objective 1

Describe Lookups SPLK-1001 Practice Questions (Page 2)

Part of the Creating and Using Lookups domain, which accounts for 6% of the SPLK-1001 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~2–2 in this domain), expect 1–1 from this objective — we provide 20 practice questions to prepare you well beyond it. (estimate)

20questions here

4free pages

4concepts

6%of the exam

Questions 6–10

6application · medium
A Splunk user needs to create a lookup that can be updated by multiple users simultaneously and will be used to enrich events with user roles. The lookup must support real-time updates. Which lookup type should the user choose?
Select an answer first
7application · medium
A Splunk user wants to enrich web server logs with the country of origin based on the client IP address. The user has a CSV file with IP ranges and country names. What is the best way to achieve this?
Select an answer first
8expert · hard
A Splunk admin is considering using a KV store lookup for a use case where the data is updated by multiple applications in real-time. However, the admin is concerned about the complexity of managing the KV store. What is the primary advantage of using a KV store lookup over a static CSV lookup in this scenario?
Select an answer first
9foundation · easy
What is a key difference between a static lookup and a dynamic lookup in Splunk?
Select an answer first
10expert · hard
A Splunk admin is asked to enrich events with a 'business_unit' field based on the user's email domain. The mapping is stored in a CSV file. The admin wants to ensure that the lookup is applied automatically to all searches without requiring users to manually invoke it. What should the admin do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1001” is a trademark of its owner, used for identification only.