Examine a Lookup File Example SPLK-1001 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A lookup file `devices.csv` has `mac` and `owner`. An analyst runs: `index=network | lookup devices mac OUTPUT owner | stats count by owner`. The events contain `mac` values, some of which are not in the lookup file. What will the `stats` output include?

   • ACounts only for owners that matched; unmatched events are dropped.
   • BAn error because the owner field is missing from some events.
   • CA single count of all events, ignoring the owner field.
   • DCounts for each owner that matched, plus a count for events with no owner (null).
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a valid representation of a lookup file structure that Splunk can use?

   • AA CSV file with a header row and data rows
   • BA JSON file with nested objects and arrays
   • CA text file with key-value pairs separated by semicolons
   • DAn Excel file with multiple sheets
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A lookup file `assets.csv` has `asset_id` and `owner`. An analyst runs: `index=network | lookup assets asset_id OUTPUT owner | search owner=alice`. The events contain `asset_id` values that are either in the file or not. What is the most accurate description of the result?

   • AThe search returns an error because `owner` is not a field in the original events.
   • BEvents with `asset_id` not in the lookup file are returned with `owner=alice` by default.
   • CAll events are returned, but only those with a matching `owner` are shown.
   • DOnly events with `asset_id` values in the lookup file AND whose `owner` is 'alice' are returned.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An analyst has a lookup file `servers.csv` with `hostname` and `environment`. The analyst runs: `index=os | lookup servers hostname OUTPUT environment | search environment=production`. What does this search do?

   • AIt errors because `search` cannot be used after `lookup`.
   • BIt filters events to only those with `hostname` in the lookup file, then adds `environment`.
   • CIt enriches events with `environment`, then filters to only events where `environment` equals 'production'.
   • DIt replaces the `hostname` field with the `environment` field.
   Reveal Solution Discussion Select an answer first
6. 10application · easy

   A lookup file `app_catalog.csv` has the following structure: `app_id,app_name,category` `A1,Word,Productivity` `A2,Excel,Productivity` `A3,PowerPoint,Productivity` An analyst runs `index=usage | lookup app_catalog app_id OUTPUT app_name`. The events contain `app_id` values A1, A2, A3, and A4. What is the result?

   • AOnly the A1 event gets `app_name` because it is the first row.
   • BAll events get `app_name`, with A4 receiving 'Unknown'.
   • CEvents with A1, A2, and A3 get `app_name`; the A4 event is unchanged.
   • DNo events get `app_name` because the lookup file has a `category` column.
   Reveal Solution Discussion Select an answer first