Splunk Enterprise Certified Admin — Question 31

For a KV store, a lookup stanza in the transforms.conf file must contain which of the following? (Select all that apply.)

Answer options

• A. collection
• B. fields_list
• C. external_type
• D. internal_type

Correct answer: A, B

Explanation

The correct options are A and B because a lookup stanza must define the 'collection' for the data source and the 'fields_list' to specify which fields are included in the lookup. Options C and D, while potentially relevant in other contexts, are not required for a basic KV store lookup configuration.