Automatic Lookup Setup in Splunk

Quick Answer

The requirement here has two parts: the enrichment must happen automatically for every search without anyone invoking a lookup command, and it must not add unnecessary performance overhead. Defining the lookup as an automatic lookup, configured through a transforms.conf stanza that points to the lookup table and a props.conf stanza that attaches it to the relevant sourcetype, satisfies both at once. Because the lookup is tied to the sourcetype itself, Splunk applies it at search time to every matching event automatically, so analysts never need to remember to add a lookup command to their searches, and updates to the underlying weekly-refreshed lookup file are picked up the next time the lookup runs without any reconfiguration. This is different from manually invoking the lookup command in an individual search, which only enriches that one search and has to be repeated everywhere it's needed, or from building the enrichment into the indexing pipeline, which would add unnecessary overhead for data that is only needed at search time. Whenever a scenario asks for enrichment that applies automatically across all searches, updates on its own schedule, and stays efficient, that combination of requirements is the signature of an automatic lookup defined through props.conf and transforms.conf rather than a manually invoked one.