Examine a Lookup File Example SPLK-1001 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How is a lookup file referenced in a Splunk search to enrich events?

   • ABy using the `lookup` command followed by the lookup table name and the field mapping.
   • BBy using the `inputlookup` command to load the file into the search as events.
   • CBy using the `table` command to display the lookup file.
   • DBy using the `eval` command to manually join fields.
   Reveal Solution Discussion Select an answer first
2. 12application · easy

   A lookup file `regions.csv` has `zip` and `territory`. An analyst runs: `index=orders | lookup regions zip OUTPUT territory`. The events have a field `zip`. What is the result?

   • AEvents with a `zip` value in the lookup file get a `territory` field; others are unchanged.
   • BAn error occurs because the lookup file has a `territory` column.
   • CAll events get a `territory` field, with unmatched events receiving 'Unknown'.
   • DOnly events with a `zip` value are returned; unmatched events are dropped.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A lookup file `employees.csv` has `emp_id` and `manager`. An analyst runs: `index=hr | lookup employees emp_id OUTPUT manager | search manager=bob`. The events contain `emp_id` values, some of which are not in the lookup file. What is the most accurate description of the result?

   • AAll events are returned, but only those with a matching `manager` are shown.
   • BOnly events with `emp_id` values in the lookup file AND whose `manager` is 'bob' are returned.
   • CThe search returns an error because `manager` is not a field in the original events.
   • DEvents with `emp_id` not in the lookup file are returned with `manager=bob` by default.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A lookup file contains the following data: status_code,description 200,OK 404,Not Found When a search event has a field `status` with value 404, how does Splunk use this lookup file to enrich the event?

   • AIt matches the `status` field to the `status_code` field and adds the corresponding `description` field to the event.
   • BIt ignores the lookup because the field names do not match exactly.
   • CIt creates a new event for each row in the lookup file.
   • DIt replaces the `status` field with the `description` field value.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A lookup file `employees.csv` has `emp_id` and `department`. An analyst runs: `index=hr | lookup employees emp_id OUTPUT department | search department=engineering`. The events contain `emp_id` values, some of which are not in the lookup file. What is the result?

   • AOnly events with `emp_id` values in the lookup file AND whose `department` is 'engineering' are returned.
   • BAll events are returned, but only those with a matching `department` are shown.
   • CThe search returns an error because `department` is not a field in the original events.
   • DEvents with `emp_id` not in the lookup file are returned with `department=engineering` by default.
   Reveal Solution Discussion Select an answer first