Splunk Core Certified User — Question 35

What must be done before an automatic lookup can be created? (Choose all that apply.)

Answer options

• A. The lookup command must be used.
• B. The lookup definition must be created.
• C. The lookup file must be uploaded to Splunk.
• D. The lookup file must be verified using the inputlookup command.

Correct answer: B

Explanation

To create an automatic lookup, it is essential to first create the lookup definition, as this defines how the lookup will work. While the lookup command, uploading the file, and verifying the file are important steps, they are not prerequisites for defining the lookup itself.