Lookups are used to enrich log data with additional data not found in the log events themselves. They allow you to key off one or more fields in the event data and add additional fields to this data. These additional fields are commonly added by looking up the specified fields in a static CSV-based lookup table and then bringing back additional fields associated with that specific entry in the table. However, lookups can also be a lot more dynamic, leveraging Python scripts, using Splunk's built-in Key-Value (KV) store, or directly looking up fields in an external database table. Lookup tables can also contain time fields to allow for time-based lookups in a given time period.
While external lookups using Python scripts are usually ...
