How to add a custom lookup in Enterprise Security?

[N92]

I have seen documents for this. As per document path should be below.
Select Configure > Content Management.
Click Create New Content > Managed Lookup.

But I can' see any option for this. Screenshot attached.

[smoir_splunk · Accepted solution]

Only version 5.0.0 of Splunk Enterprise Security has the navigation described in the documentation you're reading. Previous versions you can use Configure > Data Enrichment > Lists and Lookups and create a lookup there. I don't recommend creating a lookup from the Splunk core manager, because then it won't be a managed lookup with additional metadata provided by ES.

[amitm05]

Which version of Enterprise Security App you are working on ?

You can also create a lookup by directly going to "Settings" > Lookups > Lookup Table Files
Just that while creating the lookup, Select Destination app as "SplunkEnterpriseSecuritySuite" from the dropdown box.

Hope this helps. If this answers your ques please upvote and Accept as answer so that other people can also benefit. Thanks 🙂