nerdexam
Splunk

SPLK-1002 · Question #59

Use this command to use lookup fields in a search and see the lookup fields in the field sidebar.

The correct answer is B. lookup. The lookup command enriches existing search events with lookup table fields and surfaces those fields in the field sidebar, making it the correct command for using lookup data alongside events.

Working with Lookups

Question

Use this command to use lookup fields in a search and see the lookup fields in the field sidebar.

Options

  • Ainputlookup
  • Blookup

How the community answered

(35 responses)
  • A
    6% (2)
  • B
    94% (33)

Why each option

The `lookup` command enriches existing search events with lookup table fields and surfaces those fields in the field sidebar, making it the correct command for using lookup data alongside events.

Ainputlookup

The `inputlookup` command retrieves and returns the raw contents of a lookup file as standalone search results rather than enriching existing events, so its output fields do not appear in the field sidebar alongside indexed event fields.

BlookupCorrect

The `lookup` command joins a lookup table to existing search events by matching on a specified field, appending the matched lookup columns to each event and making them visible in the field sidebar. This is the correct command when the goal is to enrich events with additional reference data during a search.

Concept tested: Splunk lookup command vs inputlookup command

Source: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup

Topics

#Splunk commands#lookup command#field enrichment#search commands

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice