A knowledge object that enables the addition of fields and related values to search results based on field matching with a CSV table or a Python script. For example, you can use a lookup to perform DNS or reverse DNS lookups on IP addresses or host names in your data.

You can incorporate lookups into dashboards and other app views.

You can configure lookups manually in props.conf and transforms.conf, or you can create automatic lookups through Splunk Web. When you use Splunk Web to define lookups, you create a lookup definition where you indicate whether the lookup is file-based or external and provide the name of either the CSV file or the Python script that Splunk Enterprise uses for the lookup. Then you include the name of the lookup definition in the configuration of the automatic lookup.

For more information

In the Knowledge Manager Manual:

In the Developing Views and Apps for Splunk Web:


configuration file

event processing

character set encoding




timestamp, timezone offset

default field extraction

host, source, source type, punct


retention time