Examine a Lookup File Example SPLK-1001 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An analyst has a lookup file `accounts.csv` with `acct_id` and `status`. The analyst runs: `index=finance | lookup accounts acct_id AS account_id OUTPUT status`. The events have a field `account_id`. What is the result?

   • AAll events get a `status` field, with unmatched events receiving 'Unknown'.
   • BAn error occurs because the lookup field name and event field name are different.
   • COnly events with an `account_id` value are returned; unmatched events are dropped.
   • DEvents with an `account_id` value in the lookup file get a `status` field; others are unchanged.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A lookup file `users.csv` has `user_id` and `role`. An analyst runs: `index=auth | lookup users user_id OUTPUT role | stats count by role`. The events contain `user_id` values, some of which are not in the lookup file. What is the most accurate statement about the `stats` output?

   • AIt shows an error because the role field is missing from some events.
   • BIt shows only counts for roles that matched; unmatched events are excluded from the output.
   • CIt shows a single count of all events, ignoring the role field.
   • DIt shows counts for each role that matched, plus a count for events with no role (null).
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A lookup file `users.csv` contains `username` and `full_name`. An analyst runs: `index=auth | lookup users username OUTPUT full_name | stats count by full_name`. Some events have a `username` value that is not in the lookup file. What will the `stats` command show?

   • AOnly counts for full_name values that matched; unmatched events are dropped.
   • BAn error because the full_name field is missing from some events.
   • CA single count of all events, ignoring the full_name field.
   • DA count for each full_name that matched, plus a count for events with no full_name (null).
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst has a CSV file named employee_map.csv with the following content: employee_id,department,manager 1001,Sales,Alice 1002,Engineering,Bob 1003,Finance,Carol The analyst runs this search: `index=main sourcetype=access_log | lookup employee_map employee_id OUTPUT department`. The events in the access log contain a field called `emp_id`. What is the most likely reason the lookup returns no enriched results?

   • AThe lookup field name `employee_id` does not match the event field `emp_id`.
   • BThe OUTPUT clause must list all fields from the lookup file, not just `department`.
   • CThe lookup file must be named exactly `employee_map.csv` and placed in the default app directory.
   • DThe lookup command requires the `max_matches` parameter to be set to 1 for CSV lookups.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A lookup file `products.csv` has `sku` and `price`. An analyst runs: `index=sales | lookup products sku OUTPUT price | where price > 100`. The events contain `sku` values, some of which are not in the lookup file. What is the result?

   • AAll events are returned, but only those with a `price` are shown.
   • BOnly events with a matching `sku` AND a `price` greater than 100 are returned.
   • CEvents with `sku` not in the lookup file are returned with `price=0`.
   • DThe search returns an error because `price` is not a field in the original events.
   Reveal Solution Discussion Select an answer first