thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Lookup

A Splunk knowledge object that enriches events by matching field values against an external table or source.

Definition

Lookups can be CSV files, KV store collections, external scripts or geospatial definitions. They add context such as asset owner, threat intelligence status or user department. Automatic lookups apply at search time without being specified in each search.

Example

| lookup asset_inventory ip AS src_ip OUTPUT owner criticality

Exam tip

Lookups are the Splunk mechanism for enrichment; inputlookup reads a lookup table directly.

Related terms