SPLK-1001 · Question #33
Use this command to use lookup fields in a search and see the lookup fields in the field sidebar.
The correct answer is B. lookup. lookup (option B) is the correct command because it enriches search results by joining fields from an external lookup table into your active search pipeline, making those additional fields visible in the field sidebar alongside your event data. inputlookup (option A) is wrong…
Question
Use this command to use lookup fields in a search and see the lookup fields in the field sidebar.
Options
- Ainputlookup
- Blookup
How the community answered
(46 responses)- A28% (13)
- B72% (33)
Explanation
lookup (option B) is the correct command because it enriches search results by joining fields from an external lookup table into your active search pipeline, making those additional fields visible in the field sidebar alongside your event data.
inputlookup (option A) is wrong for this context because it reads an entire lookup table as its own dataset - essentially treating the lookup file as a search source rather than enriching existing search results. It populates results with lookup data directly, not as supplementary fields to existing events, so the sidebar behavior differs.
Memory tip: Think of lookup as "look UP additional info about my current results" (like looking up a contact in your address book while reading an email), whereas inputlookup is "use the lookup file itself AS my input" - it's in the name: inputlookup = make the lookup your input source.
Community Discussion
No community discussion yet for this question.