when i was learning splunk i encountered following question:
analyze following SPL query
* | outputlookup my dummy.cvs
if no events were generated for the query, choose the appropriate option
available answers :
a.at least one event needs to be created to add results to mydummy
b.my dummy .cvs will be created but the file will be empty
c.outputlook cannot be used for queries which generate 0 results
d. my dummy.cvs should be created before events can be added
e. my dummy.cvs will be created
im doubting between C or D , or am i totally wrong ?
Hi @kimmyb ,
The best way to learn is to try it for yourself in your own Splunk test environment. You can test this on the free license or sales trial.
Make a query that generates no results:
index=bunk sourcetype=bunk | outputlookup my dummy.cvs
Then use inputlookup. If the csv does not exist, you will get an error message.
| inputlookup dummy.cvs
problem is , i cant install on my work pc, no admin rights
so for me i can t put theory into practise 😞
So thats why im following all sorts of learnings on splunk in order to get to now more about it.
Hi @kimmyb,
in this case you have a problem: you need an environemt for your tests and practice.
Eventually ask to your company to have a cloud environment to install yur Splunk, otherwise it will be very difficoult (or probably an impossible mission!) for you!
Ciao.
Giuseppe
indeed 😞
all the theory seperate look ok but putting it in large picture without test env indeed is difficult
Hi @kimmyb,
usually isn't correct to answer in Community to an examination question!
Anyway in my opinion, you're totally wrong!
Ciao.
Giuseppe
it was not in an exam, just in between my learnings