The variability of your data is unlimited, so your tools should be too. Splunk Cloud’s out-of-the-box features provide everything you need to get started searching and gaining insights to your data. But when those insights lead to deeper questions, Splunk Cloud gives you the flexibility to extend its base capabilities using lookups and field extractions.
Splunk Cloud customers do not have the ability to directly edit .conf files. However, the Splunk field extractor enables you to create new, custom fields to build search-time field extractions that are associated with specific source types through the Splunk Web user interface.
Lookups match field-value combinations in your event data with field-value combinations in external lookup tables. If Splunk software finds those field-value combinations in your lookup table, it appends the corresponding field-value combinations from the table to the events in your search.
Splunk determines configuration priorities based on factors such as the current user and current app (scope) and alpha-numeric name sorting (lexicographical naming). This enables to tune your data's source type and increase the performance of indexing and searching.
Fields are the building blocks of Splunk searches, reports, and data models. When you run a search on your event data, Splunk software looks for fields in that data. Fields appear in event data as searchable name-value pairings.
You can build field extractions with the field extractor to build search-time field extractions. After you run a search, fields extracted for that search are listed in the fields sidebar. You can create custom field extractions to define which fields are extracted and when Splunk software extracts fields.
Lookups can reference fields that are added to events by field extractions, field aliases, and calculated fields. They cannot reference event types and tags. Lookups are extremely powerful in that they can augment existing data with information that isn't stored in Splunk. You can create lookups in Splunk Web through the Settings pages for lookups.