I85PREP
⌘ K
Splunk Core Certified User study materials
Splunk Core Certified User study resources

Splunk Core Certified User: Fields, Lookups, and Knowledge Objects

Splunk Core Certified User · Work through your exam, one topic at a time.

All guide sections

Fields, Lookups, and Knowledge Objects

Fields

Fields are searchable name/value pairs. Default fields exist on every event: host, source, sourcetype, index, _time, linecount, splunk_server, plus the raw text in _raw. Other fields are extracted at search time from configurations (props.conf/transforms.conf) or by knowledge objects.

Field-level knowledge objects

  • Field extraction - regex or delimiter based, often created from an event's "Extract fields" action.
  • Calculated field - a new field whose value comes from an eval expression.
  • Field alias - an alternate name pointing at an existing field (same value, second name).
  • Tags - labels on field/value pairs; search with tag=privileged.
  • Event types - a saved search that categorizes events, searchable as eventtype=login_failure.

Lookups

Lookups enrich events with an external table. A lookup table file (usually CSV) holds the data; a lookup definition names it and defines matching fields and case sensitivity. | lookup products.csv product_id applies it ad hoc; an automatic lookup applies with no command at all. | inputlookup reads the file directly; | outputlookup writes results back to it.

Traps

A CSV file alone is not enough for an automatic lookup - you also need the definition. Calculated field versus alias is a favorite: alias = same value, new name; calculated = new value. Knowledge objects are private by default and must be shared to an app or globally for others to use them.

Rule of thumb: new name, same value → alias; new value from existing fields → calculated field; new value from a table → lookup.