Which of the following can be used to access external lookups?

An external lookup in Splunk is executed via a script or command defined in transforms.conf using the externalcmd setting. Splunk can run any command-line executable program. This includes interpreted scripts written in languages like Python, which is the modern standard for Splunk scripting, as well as compiled programs, which are referred to as binary executables. Therefore, both Python scripts and binary executables are valid methods for creating and accessing external lookups.

A. This is incomplete. While both Perl and Python scripts can be used, this option omits the entire category of compiled binary executables, which are also supported.

B. Ruby is not a natively supported or documented language for Splunk's external lookup scripting interface, making this option incorrect.

C. This is less accurate than option D. While Perl is supported, Python is the more modern and recommended scripting language for Splunk development.

1. Splunk Enterprise Documentation, Knowledge Manager Manual, "Define an external lookup in transforms.conf":

Section: Define an external lookup in transforms.conf

Quote/Content: "The script can be any binary executable or script that can be run from the command line, such as a Python or Perl script." This directly confirms that both binary executables and scripts (with Python being a primary example) are supported.

2. Splunk Enterprise Documentation, Admin Manual, "transforms.conf":

Section: [] > externalcmd

Quote/Content: "Path to the external command that you want to run. This command must be an executable file." This specification confirms that any executable file, which includes both compiled binaries and scripts with a shebang line (like Python), can be used.