Data enrichment with lookups
Occasionally you will come across pieces of data that you wish were rendered in a more readable manner. A common example is HTTP status codes. Computer engineers are often familiar with status codes as three-digit numbers. Business analysts, however, would not necessarily know the meaning of these codes. In Splunk, you solve this predicament by using lookup tables, which can pair numbers or acronyms with more understandable text classifiers.
A lookup table is a mapping of keys and values that Splunk can query so it can translate fields into more meaningful information at search time. This is best understood through an example. You can go through the following steps:
From the Destinations app, click on Settings and then Lookups:
In the Lookups page, click on the Add new option next to Lookup table files, as shown in the following screenshot:
In the Add new page, make sure that the Destinations app is selected.
Then, using the following screenshot as your guide, in...
