ExamTopics Logo
Mail Us[email protected]
Menu
Splunk Discussions
exam questions

Exam SPLK-3001 All Questions

View all questions & answers for the SPLK-3001 exam
Go to Exam

Exam SPLK-3001 topic 1 question 23 discussion

Actual exam question from Splunk's SPLK-3001
Question #: 23
Topic #: 1
[All SPLK-3001 Questions]

How should an administrator add a new lookup through the ES app?

  • A. Upload the lookup file in Settings -> Lookups -> Lookup Definitions
  • B. Upload the lookup file in Settings -> Lookups -> Lookup table files
  • C. Add the lookup file to /etc/apps/SplunkEnterpriseSecuritySuite/lookups
  • D. Upload the lookup file using Configure -> Content Management -> Create New Content -> Managed Lookup
Show Suggested Answer Hide Answer
Suggested Answer: D 🗳️
by mi5 at Nov. 19, 2021, 5:15 p.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
jaemon22
6 months, 2 weeks ago
answer should be B This allows you to upload the lookup file so it can be managed and used within Splunk Enterprise Security.
upvoted 1 times
...
qtygbapjpesdayazko
1 year, 8 months ago
Selected Answer: D
Suggested Answer: D
upvoted 2 times
...
sylax
2 years, 5 months ago
Selected Answer: D
pg 242 Administering Splunk Enterprise Security 7.0
upvoted 4 times
...
andy73
3 years ago
D is correct
upvoted 3 times
...
mi5
3 years ago
Selected Answer: D
D is right
upvoted 3 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel