While fetching the data after Splunk search, we sometimes get to see the field details which don’t convey meaning as such. Example: By looking at process ID, we can't get an idea about what application process it is referring to. So, it becomes difficult for a human to understand the same. Therefore, linking process ID with process name can give us a better idea in understanding.  Such linking of values of one field to a field with the same name in another dataset using equal values from both the data sets is called a lookup process.   This helps us in retrieving the related values from two different data sets. Not only this, lookups help to expand event data by adding variations of the field value from the search tables. Splunk software uses lookups to retrieve specific fields from an external file to get the value of an event.   For creating a lookup, we can navigate to Settings, where we have Lookup, through which we can proceed to fill the data fields and create a lookup for the required data set.  We have different types of Lookups that can be used as per the scenario: There are four types of lookups:  CSV lookups  External lookups  KV Store lookups  Geospatial lookups