if no events

[kimmyb]

when i was learning splunk  i encountered following question:

analyze  following SPL query
* | outputlookup my dummy.cvs
if no events were generated for the query, choose the appropriate option

available answers :

a.at least one event needs to be created to add results to mydummy
b.my dummy .cvs will be created but the file will be empty
c.outputlook cannot be used for queries which generate 0 results
d. my dummy.cvs should be created before events can be added
e. my dummy.cvs  will be created

im doubting between C or D , or am i totally wrong ?

[chaker]

Hi @kimmyb ,

The best way to learn is to try it for yourself in your own Splunk test environment. You can test this on the free license or sales trial.

Make a query that generates no results:

index=bunk sourcetype=bunk  | outputlookup my dummy.cvs

Then use inputlookup. If the csv does not exist, you will get an error message.

| inputlookup dummy.cvs

[kimmyb]

problem is , i cant install on my work pc, no admin rights 
so for me i can t put theory into practise 😞

So thats why im following all sorts of learnings on splunk in order to get to now more about it.

[gcusello]

Hi @kimmyb,

in this case you have a problem: you need an environemt for your tests and practice.

Eventually ask to your company to have a cloud environment to install yur Splunk, otherwise it will be very difficoult (or probably an impossible mission!) for you!

Ciao.

Giuseppe

[kimmyb]

indeed 😞
 all the theory seperate look ok but putting it in large picture without  test env indeed is difficult

[gcusello]

Hi @kimmyb,

usually isn't correct to answer in Community to an examination question!

Anyway in my opinion, you're totally wrong!

Ciao.

Giuseppe

[kimmyb]

it was not in an exam, just in between my learnings