I need to enrich my event data (web logs) with several other fields based on a value of one of the events fields. I plan to use a lookup that calls an script to go get the fields.
When I run the search again, containing the lookup, will it go and lookup events that were already looked up? Does splunk know to only enrich events that not yet enriched?
Looks like OUTPUTNEW is the answer.