A lookup table file is simply a CSV file. The first line is treated as a list of field names for all the other lines.
Lookup table files are managed at Settings | Lookups | Lookup table files. Simply upload a new file and give it a filename, preferably ending in .csv. An example lookup file (users.csv) is shown as follows:
user,city,department,state steve,Dallas,HR,TX shelby,Dallas,IT,TX mary,Houston,HR,TX nanette,Houston,IT,TX tuck,Chicago,HR,IL
With this file uploaded, we can immediately use it with the lookup command. In the simplest case, the format of the lookup command is as follows:
lookup [lookup definition or file name] [matching field]
An example of its usage is as follows:
sourcetype=" impl_splunk_gen_SomeMoreLogs" ...
