nerdexam
Splunk

SPLK-1002 · Question #60

It is mandatory for the lookup file to have this for an automatic lookup to work.

The correct answer is D. Input filed. For an automatic lookup to function in Splunk, the lookup file must contain an input field that maps to a field present in the indexed events.

Working with Lookups

Question

It is mandatory for the lookup file to have this for an automatic lookup to work.

Options

  • ASource type
  • BAt least five columns
  • CTimestamp
  • DInput filed

How the community answered

(26 responses)
  • A
    4% (1)
  • C
    4% (1)
  • D
    92% (24)

Why each option

For an automatic lookup to function in Splunk, the lookup file must contain an input field that maps to a field present in the indexed events.

ASource type

Source type is a configuration setting used to define which events trigger the automatic lookup, not a required column inside the lookup file itself.

BAt least five columns

There is no minimum column count requirement for a lookup file; automatic lookups can work with as few as two columns.

CTimestamp

A timestamp column is not required in a lookup file; lookup tables are typically static reference data without time-based fields.

DInput filedCorrect

An automatic lookup requires an input field - a column in the lookup table that corresponds to a field present in the search events - so Splunk can determine which lookup row to join to each event. Without this matching input field, the automatic lookup has no basis for linking lookup data to the correct events.

Concept tested: Splunk automatic lookup input field requirement

Source: https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/DefineanautomaticlookupinSplunkWeb

Topics

#lookups#automatic lookups#lookup file#field matching

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice