Simple explanation
Rather than manually invoking a lookup with the lookup command every time, an automatic lookup applies itself to every relevant search without any extra typing.
Technical explanation
- Automatic lookup configuration: Settings > Lookups > Automatic lookups, associating a lookup definition with a specific sourcetype (or source/host), so it applies whenever matching events are searched — no need to remember to type
| lookup ...in every relevant search. - Prerequisites for creating an automatic lookup: the lookup definition must already exist (file uploaded, definition created) before it can be configured to run automatically.
- When automatic lookups are worth setting up: when a lookup is used FREQUENTLY, across many different searches/users, on the same sourcetype — the upfront configuration effort pays off by eliminating the need to remember and retype the manual lookup syntax every time.
- Performance consideration: an automatic lookup runs on every search touching that sourcetype, whether or not the enrichment is actually needed for that specific search — for very high-volume sourcetypes, this is worth being deliberate about, since it adds processing overhead universally rather than only when explicitly requested.
- Automatic lookups still show up as regular fields — once configured, the enriched fields simply appear alongside other fields for matching events, indistinguishable in the results from a natively-extracted field, from the user's perspective.
Synonyms / related terms
| Term | Means |
|---|---|
| Automatic lookup | A lookup applied to every search matching a specified sourcetype, without manual invocation |
| Manual lookup | Using the explicit | lookup command in a specific search |
Concept Check
"A team frequently and manually types the same | lookup command across dozens of different daily searches on the same high-volume sourcetype." This is exactly the situation an automatic lookup is designed to eliminate — rather than continuing to manually retype the same lookup invocation repeatedly across many searches, configuring it once as an automatic lookup for that sourcetype removes the repeated manual step going forward.
Interview-style Q&A
Q: Why wouldn't you just make every lookup automatic, given the convenience? A: "Because that convenience isn't free — every automatic lookup adds processing overhead to every single search touching its associated sourcetype, whether or not that particular search actually needs the enrichment. For a lookup that's only occasionally relevant, or for very high-volume data, the better trade-off is often keeping it manual, invoked explicitly only when actually needed, rather than paying that overhead universally."
Memory trick
"Automatic saves Typing, but costs Overhead everywhere" — the trade-off in one sentence, worth weighing before configuring any lookup as automatic.