Enriching Data with Lookups

Duration : 1 Day (8 Hours)

Enriching Data with Lookups Course Overview:

This course is tailored for knowledge managers aiming to leverage lookups for enhancing their search environment within Splunk. The course covers various aspects of lookups, including lookup types, uploading and defining lookups, creating automatic lookups, utilizing advanced lookup options, verifying lookup contents in search, and reviewing lookup best practices.

Intended Audience:

  • Knowledge Managers
  • Splunk Administrators
  • Data Analysts
  • Business Intelligence Professionals
  • Anyone responsible for managing and utilizing lookups within the Splunk environment.

Learning Objectives of Enriching Data with Lookups:

  • Understanding Lookups
  • Creating Lookups
  • Geospatial Lookups
  • External Lookups
  • KV Store Lookups
  • Best Practices for Lookups

Topic 1 – What is a Lookup?

  • Define a lookup and the default lookup types.
  • Understand the role of lookups in the search-time operation sequence.

Topic 2 – Create Lookups

  • Describe the purpose of lookups at search time.
  • Use file-based lookups and examine a CSV lookup file.
  • Create a lookup by uploading, defining, and configuring it.
  • Apply advanced lookup options.
  • Create and utilize automatic lookups during search.

Topic 3 – Geospatial Lookups

  • Describe the use of geospatial lookups.
  • Examine KML/KMZ geospatial lookup files.
  • Add a geospatial lookup file to Splunk.
  • Define a geospatial lookup for use in searches.

Topic 4 – External Lookups

  • Define the purpose of external lookups.
  • Examine an external_lookup.py lookup script.
  • Configure external lookups to enhance search results.

Topic 5 – KV Store Lookups

  • Define the use of KV Store lookups in Splunk.
  • Identify the steps involved in setting up a KV Store lookup.
  • Examine the collections.conf file for KV Store lookups.
  • Create a KV Store lookup definition.
  • Explore options for populating a KV Store lookup.
  • Compare file-based CSV lookups with KV Store lookups for efficiency and functionality.

Enriching Data with Lookups Course Prerequisites:

  • Search Under the Hood
  • Creating Knowledge Objects

Discover the perfect fit for your learning journey

Choose Learning Modality

Live Online

  • Convenience
  • Cost-effective
  • Self-paced learning
  • Scalability


  • Interaction and collaboration
  • Networking opportunities
  • Real-time feedback
  • Personal attention


  • Familiar environment
  • Confidentiality
  • Team building
  • Immediate application

Training Exclusives

This course comes with following benefits:

  • Practice Labs.
  • Get Trained by Certified Trainers.
  • Access to the recordings of your class sessions for 90 days.
  • Digital courseware
  • Experience 24*7 learner support.

Got more questions? We’re all ears and ready to assist!

Request More Details

Please enable JavaScript in your browser to complete this form.

Subscribe to our Newsletter

Please enable JavaScript in your browser to complete this form.