The regular Splunk tutorial may or may not have an example (I don't know for sure), but here's one that you can follow to get a reasonable example of how to do these things.
A close reading of the docs for lookup may also suggest at least things to try.
One thing you might need to do is make sure you have a field to join them up on - nt_host is fine, but it would have to be on both sides (not necessarily with the same name - just the contents.)
... | lookup TheNameOfMyLookup FieldInLookup1 AS FieldNameInEvent1 OUTPUT appowner AS MyNewAppOwnerName application AS MyNewApplicationName
It's just a sample, but hopefully this gets you started.