Examine a Lookup File Example SPLK-1001 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An analyst has a lookup file `locations.csv` with `store_id` and `city`. The analyst runs: `index=pos | lookup locations store_id OUTPUT city | stats count by city`. What will the results show?

   • AAn error because the city field is missing from some events.
   • BA count of events for each city, plus a count for events with no city (unmatched).
   • CA single count of all events, ignoring the city field.
   • DOnly counts for cities that matched; unmatched events are dropped.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A lookup file named employee.csv contains the following content: employee_id,department,full_name 1001,Sales,Alex Johnson 1002,Engineering,Sam Rivera What is the correct description of the structure of this lookup file?

   • AThe first row is a header row that defines field names, and each subsequent row is a record with values for those fields.
   • BEach row is a separate lookup table, and the columns represent different lookup tables.
   • CThe file has no defined structure; Splunk infers fields based on the data type of each value.
   • DThe first column is a header column that defines field names, and each subsequent column is a record with values for those fields.
   Reveal Solution Discussion Select an answer first
4. 3application · easy

   A lookup file `devices.csv` has the following rows: `device_id,model,os_version` `D100,iPhone,17.1` `D200,iPad,17.2` `D300,MacBook,14.5` An analyst runs `index=mdm | lookup devices device_id OUTPUT model os_version`. The events contain a `device_id` field. How many events will be enriched if the events contain device IDs D100, D200, and D400?

   • ATwo events (D100 and D200) will be enriched; D400 has no match.
   • BAll three events will be enriched, with D400 receiving blank values.
   • COnly D100 will be enriched because it is the first row in the file.
   • DNo events will be enriched because the lookup file has too many columns.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary purpose of using a lookup file in a Splunk search?

   • ATo reduce the storage size of the index by removing duplicate events.
   • BTo enrich events with additional fields from an external reference table.
   • CTo permanently modify the indexed data in Splunk.
   • DTo create new indexes for faster search performance.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An analyst has a lookup file `departments.csv` with `dept_code` and `dept_name`. The analyst runs: `index=hr | lookup departments dept_code AS dept OUTPUT dept_name | stats count by dept_name`. The events have a field `dept`. Some events have `dept` values not in the lookup file. What is the result?

   • AAn error because the dept_name field is missing from some events.
   • BA single count of all events, ignoring the dept_name field.
   • CCounts for each dept_name that matched, plus a count for events with no dept_name (null).
   • DCounts only for dept_name values that matched; unmatched events are dropped.
   Reveal Solution Discussion Select an answer first