SPLK-1002 · Question #60
It is mandatory for the lookup file to have this for an automatic lookup to work.
The correct answer is D. Input filed. For an automatic lookup to function in Splunk, the lookup file must contain an input field that maps to a field present in the indexed events.
Question
It is mandatory for the lookup file to have this for an automatic lookup to work.
Options
- ASource type
- BAt least five columns
- CTimestamp
- DInput filed
How the community answered
(26 responses)- A4% (1)
- C4% (1)
- D92% (24)
Why each option
For an automatic lookup to function in Splunk, the lookup file must contain an input field that maps to a field present in the indexed events.
Source type is a configuration setting used to define which events trigger the automatic lookup, not a required column inside the lookup file itself.
There is no minimum column count requirement for a lookup file; automatic lookups can work with as few as two columns.
A timestamp column is not required in a lookup file; lookup tables are typically static reference data without time-based fields.
An automatic lookup requires an input field - a column in the lookup table that corresponds to a field present in the search events - so Splunk can determine which lookup row to join to each event. Without this matching input field, the automatic lookup has no basis for linking lookup data to the correct events.
Concept tested: Splunk automatic lookup input field requirement
Source: https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/DefineanautomaticlookupinSplunkWeb
Topics
Community Discussion
No community discussion yet for this question.