Splunk Core Certified User Practice Exam

When configuring Lookups, how can you specify fields to keep?

1. By using the OUTPUT clause

2. By using the KEEP clause

3. By using the OUTPUTNEW clause

4. By using the RENAME clause

The correct answer is: By using the OUTPUTNEW clause

The appropriate way to specify fields to keep when configuring lookups in Splunk is by using the OUTPUTNEW clause. This clause allows you to define which fields from the lookup table should be added to the resulting events and can also create new fields or overwrite existing fields without modifying the original event fields. Essentially, OUTPUTNEW allows for greater flexibility in managing the output of your lookup operations. The OUTPUT clause, while relevant, does not distinctly offer the same functionality as OUTPUTNEW, particularly in terms of naming new fields. The KEEP clause doesn't exist in the context of lookups in Splunk, and the RENAME clause serves a different purpose: it allows you to rename fields but does not specifically relate to keeping fields. Thus, OUTPUTNEW is the correct choice as it directly aligns with the requirements for field management during the lookup process.