The Lookup Library • Room 2

Automatic Lookups & inputlookup

Automatic lookups apply a lookup to every search automatically based on a sourcetype, without needing to add the `| lookup` command. These are configured in Settings > Lookups > Automatic lookups.

`inputlookup` reads an entire lookup table as if it were search results. This is useful for browsing the lookup file or using it as the primary data source.

`outputlookup` writes search results to a lookup table, letting you dynamically update lookup content from your searches.

Read a lookup table

| inputlookup employee_list.csv | search department="Engineering"

Write results to a lookup

index=assets | stats latest(os) as os by host | outputlookup host_inventory.csv

Knowledge Check

Prove your understanding to clear the room (Rewards XP)

Drag items to their correct zone (or tap item then tap zone on mobile)

Reads an entire lookup table as search results

Writes search results to a lookup file

Enriches events by adding fields from a table

inputlookup

outputlookup

lookup