Splunk Infrastructure Overview — Question 39

How can a lookup be referenced in an alert?

Answer options

• A. Use the lookup dropdown in the alert configuration window.
• B. Follow a lookup with an alert command in the search bar.
• C. Run a search that uses a lookup and save as an alert.
• D. Upload a lookup file directly to the alert.

Correct answer: C

Explanation

The correct answer is C because saving a search that includes a lookup as an alert allows the alert to utilize the lookup data effectively. Options A and B do not provide a way to save the lookup in the alert, and option D is incorrect because alerts cannot be set up by uploading lookup files directly.