SPLK-1002 · Question #59
Use this command to use lookup fields in a search and see the lookup fields in the field sidebar.
The correct answer is B. lookup. The lookup command enriches existing search events with lookup table fields and surfaces those fields in the field sidebar, making it the correct command for using lookup data alongside events.
Question
Use this command to use lookup fields in a search and see the lookup fields in the field sidebar.
Options
- Ainputlookup
- Blookup
How the community answered
(35 responses)- A6% (2)
- B94% (33)
Why each option
The `lookup` command enriches existing search events with lookup table fields and surfaces those fields in the field sidebar, making it the correct command for using lookup data alongside events.
The `inputlookup` command retrieves and returns the raw contents of a lookup file as standalone search results rather than enriching existing events, so its output fields do not appear in the field sidebar alongside indexed event fields.
The `lookup` command joins a lookup table to existing search events by matching on a specified field, appending the matched lookup columns to each event and making them visible in the field sidebar. This is the correct command when the goal is to enrich events with additional reference data during a search.
Concept tested: Splunk lookup command vs inputlookup command
Source: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup
Topics
Community Discussion
No community discussion yet for this question.