A Splunk admin needs to create a lookup that will be used to enrich events with a list of approved applications. The list is maintained in a CSV file and is updated weekly. Which lookup type should the admin use?

Static lookup with automatic refresh

KV store lookup with real-time updates

In Splunk, what is the primary purpose of a lookup?

To schedule reports and alerts based on event data

To transform event data into a different format, such as XML or JSON

To store raw event data in a separate index for faster searching

To enrich event data by adding fields from an external source based on a common field value

A security analyst wants to add a 'severity' field to events based on the 'event_code' field. Which lookup use case does this represent?

Filtering out unwanted events from search results

Aggregating event counts over time

Creating a new index for event storage

Adding descriptive fields to event data

A Splunk admin is troubleshooting a search that is not returning the expected 'owner' field after a lookup is applied. The lookup is defined correctly and the CSV file contains the owner information. What is the most likely cause of the missing field?

The lookup is not configured as an automatic lookup

The CSV file is too large to be used as a lookup

The CSV file is not in the correct format

The lookup is using the wrong field name for the match

When would you choose a dynamic lookup (KV store) over a static lookup (CSV file)?

When you need to store a large amount of static reference data that rarely changes

When the lookup data changes frequently and needs to be updated by applications

When you want to avoid using any Splunk storage

When you need to perform complex joins between multiple lookup files

SplunkCore Certified User

Domain 7Objective 1

Describe Lookups SPLK-1001 Practice Questions (Page 3)

Part of the Creating and Using Lookups domain, which accounts for 6% of the SPLK-1001 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~2–2 in this domain), expect 1–1 from this objective — we provide 20 practice questions to prepare you well beyond it. (estimate)

20questions here

4free pages

4concepts

6%of the exam

Questions 11–15

11application · medium
A Splunk admin needs to create a lookup that will be used to enrich events with a list of approved applications. The list is maintained in a CSV file and is updated weekly. Which lookup type should the admin use?
Select an answer first
12foundation · easy
In Splunk, what is the primary purpose of a lookup?
Select an answer first
13foundation · easy
A security analyst wants to add a 'severity' field to events based on the 'event_code' field. Which lookup use case does this represent?
Select an answer first
14expert · hard
A Splunk admin is troubleshooting a search that is not returning the expected 'owner' field after a lookup is applied. The lookup is defined correctly and the CSV file contains the owner information. What is the most likely cause of the missing field?
Select an answer first
15foundation · easy
When would you choose a dynamic lookup (KV store) over a static lookup (CSV file)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1001” is a trademark of its owner, used for identification only.