A knowledge object that enables the addtion of fields and related values to search results based on field matching with a CSV table or a Python script. For example, you can use a lookup to perform DNS or reverse DNS lookups on IP addresses or host names in your data.

Lookups can be incorporated into dashboards and other app views.

You can configure lookups manually in props.conf and transforms.conf or you can create "automatic lookups" via Splunk Web. When you use Splunk Web to define lookups, you create a lookup definition where you indicate whether the lookup is file-based or external and provide the name of either the CSV file or the Python script that Splunk will use for the lookup. Then you include the name of the lookup definition in the configuration of the automatic lookup.

For more information

In the Knowledge Manager Manual:

In the Developer Manual:


configuration file

event processing

character set encoding




timestamp, timezone offset

default field extraction

host, source, source type, punct


retention time