Splunk Infrastructure Overview — Question 12
What is returned when Splunk finds fewer than the minimum matches for each lookup value?
Answer options
- A. The default value NULL until the minimum match threshold is reached.
- B. The default match value until the minimum match threshold is reached.
- C. The first match unless the time_field attribute is specified.
- D. Only the first match.
Correct answer: A
Explanation
The correct answer is A because Splunk returns NULL as the default value when there are fewer matches than the specified minimum. Options B, C, and D are incorrect because they do not accurately describe the behavior of Splunk in this scenario regarding lookup values and minimum match thresholds.