SPLK-1001 · Question #35
In automatic lookup definitions, the _____ fields are those that are not in the event data.
The correct answer is B. output. In automatic lookup definitions, output fields are those that don't exist in the event data - they are the fields that get added to the event as a result of the lookup. The lookup table contains these output fields, and Splunk appends them to matching events at search time…
Question
In automatic lookup definitions, the _____ fields are those that are not in the event data.
Options
- Ainput
- Boutput
How the community answered
(49 responses)- A27% (13)
- B73% (36)
Explanation
In automatic lookup definitions, output fields are those that don't exist in the event data - they are the fields that get added to the event as a result of the lookup. The lookup table contains these output fields, and Splunk appends them to matching events at search time, enriching the data with information not originally present in the raw log.
Option A (input) is incorrect because input fields are the opposite: they are fields that already exist in the event and are used as the key to match against the lookup table.
Memory tip: Think of it like a database JOIN - you bring in columns (output) from an external table using a key column (input) you already have. The "output" comes out of the lookup and into your event.
Community Discussion
No community discussion yet for this question.