These docs are for Cribl Stream 4.10 and are no longer actively maintained.

See the latest version (4.20).

The Lookups library lets you use data tables to enrich events by using the Lookup Function in your Pipelines.

The following usecases guide you through using lookups in specific situations:

• Ingest-Time Lookups
• Managing Large Lookups
• Lookups as Filters for Masks
• Lookups and Regex Magic
• Deploy Updated Lookup Files to Multiple Packs
• Deploy Updated Lookup Files