A knowledge object that enables the addition of fields and related values to search results based on field matching with a CSV table or a Python script. For example, you can use a lookup to perform DNS or reverse DNS lookups on IP addresses or host names in your data.
You can configure lookups manually in
transforms.conf, or you can create automatic lookups through Splunk Web. When you use Splunk Web to define lookups, you create a lookup definition where you indicate whether the lookup is file-based or external and provide the name of either the CSV file or the Python script that Splunk Enterprise uses for the lookup. Then you include the name of the lookup definition in the configuration of the automatic lookup.
For more information
In the Knowledge Manager Manual:
In the Developing Views and Apps for Splunk Web: