What must be done before an automatic lookup can be created? (select all that apply)

Question

Options

• AThe lookup command must be used.
• BThe lookup definition must be created.
• CThe lookup file must be uploaded to Splunk.
• DThe lookup file must be verified using the inputlookup command.

• A
  9% (3)
• B
  83% (29)
• C
  6% (2)
• D
  3% (1)

Explanation

Creating a lookup definition (B) is the required prerequisite for an automatic lookup because the definition is what maps the lookup file to specific fields and tells Splunk how to perform the lookup - without it, Splunk has no configuration to automate.

Why the distractors are wrong:

• A - The lookup command is used for manual lookups in a search; automatic lookups run without any command, so this is actually what you're trying to avoid needing.
• C - Uploading the lookup file is necessary at some point, but it alone is insufficient; you can upload a file without ever creating an automatic lookup. The file upload is a prerequisite to the definition, not to the automatic lookup directly.
• D - inputlookup is useful for inspecting lookup contents, but verifying a file this way is not a required step in the automatic lookup creation process.

Memory tip: Think of the order as a chain - file upload → lookup definition → automatic lookup. The question asks what must exist before automation, and the definition is the bridge between a raw CSV file and automated enrichment. No definition = no automation.

No community discussion yet for this question.