ExamFinch.com My Study

Study guide

8.2 Creating Lookup Files and Definitions

Practice this exam

Splunk Core Certified User Study Guide Exam

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts & Logistics 1.2 Study Strategy & Learning Path

2 Splunk Basics

2.1 Splunk Components 2.2 Uses of Splunk 2.3 Splunk Apps 2.4 User Settings & Basic Navigation

3 Basic Searching

3.1 Running Basic Searches 3.2 Setting Time Ranges 3.3 Contents of Search Results 3.4 Refining Searches 3.5 Using the Timeline 3.6 Working with Events 3.7 Controlling Search Jobs 3.8 Saving Search Results

4 Using Fields in Searches

4.1 Understanding Fields 4.2 Using Fields in Searches 4.3 The Fields Sidebar

5 Search Language Fundamentals

5.1 Basic Search Commands & Practices 5.2 The Search Pipeline 5.3 Specifying Indexes in Searches 5.4 table, rename, fields, dedup, and sort

6 Using Basic Transforming Commands

6.1 The top Command 6.2 The rare Command 6.3 The stats Command

7 Creating Reports and Dashboards

7.1 Saving and Editing Reports 7.2 Statistical Table Reports 7.3 Chart Visualization Reports 7.4 Creating Dashboards and Adding Reports 7.5 Editing Dashboards

8 Creating and Using Lookups

8.1 Lookup Concepts and File Examples 8.2 Creating Lookup Files and Definitions 8.3 Configuring Automatic Lookups 8.4 Using Lookups in Searches

9 Creating Scheduled Reports and Alerts

9.1 Scheduled Reports 9.2 Describing and Creating Alerts 9.3 Viewing Fired Alerts

8.2 Creating Lookup Files and Definitions

Key Takeaways Explain This Topic AI

Create CSV lookups in Settings > Lookups by uploading a lookup table file, then creating a lookup definition that references that file.

A lookup table file is the CSV content; a lookup definition is the named knowledge object you invoke with | lookup or automatic lookups.

Permissions (sharing) control which apps and users can use the lookup file and definition.

One CSV file can support more than one lookup definition, but User workflows usually create one clear definition per table.

Last updated: August 2026

From CSV on disk to a usable Splunk lookup

Topic 7.3 on the User blueprint is practical: create a lookup file and a lookup definition. In Splunk Web the home base is Settings > Lookups . That menu is where User-level questions expect you to navigate.

Under Settings > Lookups you will see (at minimum) these related areas:

  • Settings area What it stores What you do there
  • Lookup table files The CSV (or .csv.gz ) content Upload / manage the file

Lookup definitions Named definitions pointing at a table Create the object used by | lookup / automatic lookups

Automatic lookups Rules that apply a definition automatically Covered in the next section

Remember the split: the file is the data; the definition is the named configuration that tells Splunk how to use that data as a lookup.

Step 1 — Prepare a valid CSV

Before uploading, make sure the CSV is clean enough for Splunk to treat as a table:

Include a header row with field names ( status,status_description,status_type ).

Use consistent key values that will match the field values in events ( 404 should match status=404 ).

Prefer unique keys when you expect one enrichment row per match.

Keep the table relatively small and stable — that matches the classic User/static CSV pattern.

Example file name used in training scenarios: http_status.csv .

Step 2 — Upload the lookup table file

Typical User workflow:

Open Settings > Lookups > Lookup table files .

Choose Add new (wording can vary slightly by Splunk version/UI skin).

Select the Destination app (often Search & Reporting for personal/learning use, or a team app in real environments).

Upload the CSV and give it a clear file name.

Save.

After upload, the CSV exists as a lookup table file knowledge object. Uploading alone is not always enough for convenient | lookup my_definition ... usage — you normally still need a lookup definition .

Step 3 — Create the lookup definition

Go to Settings > Lookups > Lookup definitions .

Choose Add new .

Set the Destination app .

Provide a Name for the definition (for example http_status ). This name is what searches and automatic lookups usually reference.

Set Type to a file-based / CSV lookup (exact label can read like "File-based" depending on product UI).

Select the lookup file you uploaded ( http_status.csv ).

Save.

Now you have a reusable definition. In searches you can run something like: ... | lookup http_status status OUTPUT status_description, status_type

  • (Exact OUTPUT syntax is covered in section 8.4.)
  • Why both file and definition exist

Splunk separates storage from configuration:

Lookup table file = "Here is the CSV content."

Lookup definition = "Here is the named lookup called http_status that uses that CSV, with matching/advanced options as configured."

Advanced options can exist on definitions (minimum matches, default matches, case sensitivity behavior depending on configuration). For User exam readiness, prioritize the happy path: upload CSV → create CSV/file-based definition → share appropriately → use it.

Also note: documentation states that one lookup table can have multiple lookup definitions . On the exam, you usually create one straightforward definition per uploaded practice CSV.

Permissions basics (sharing)

Lookup files and definitions are knowledge objects . After creating them, set permissions so the right people and apps can use them.

Common sharing choices (conceptual):

  • Sharing level Practical meaning
  • Private Only you (owner) use it
  • App Users with access to that app can use it
  • All apps (global) Available more broadly across the instance (subject to capabilities)

Read vs write matters too. Many teammates need read so they can run lookups in searches; fewer people should have write to edit the CSV or redefine matching.

Exam-ready habit: If a question says a coworker cannot see or use your lookup, check permissions/sharing and the app context before assuming the CSV upload failed.

Destination app awareness

Creating the object in the wrong app is a frequent real-world mistake. If you upload the file to App A but create the definition in App B without proper sharing, searches in App B may not find what you expect. On scenario questions, match destination app and sharing to where users actually search.

What you are not doing in this User step

Creating a User-level CSV lookup definition is not the same as:

  • Building a data model
  • Mapping CIM fields
  • Writing macros
  • Creating tags or event types
  • Designing KV Store collections as an admin project

Those topics belong elsewhere (often Power User / Admin). Keep Domain 7.0 grounded in Settings > Lookups , CSV files, definitions, permissions, automatic lookups, and the | lookup command.

  • Checklist before moving on
  • CSV has headers and a clear key column
  • File uploaded under Lookup table files
  • Definition created under Lookup definitions and points at that file
  • Permissions allow intended users/apps to read it
  • You know the definition name you will use in searches
  • Suggested create order (User lab style)
  • Draft http_status.csv locally with header + rows
  • Settings > Lookups > Lookup table files → upload
  • Settings > Lookups > Lookup definitions → create CSV/file-based definition named http_status
  • Set sharing so your app can read it
  • Test with a manual | lookup before creating any automatic lookup

That order prevents the common mistake of configuring automation against a definition that was never verified.