Do I need to create a .csv file for the lookup field section of a saved search for CPU,memory by myself or I just need to go online to get the file?
You would need to create a csv file for the lookup yourself so it includes all of the values you want to use in the lookup. Once you have done this download and follow the instructions in the Knowledge Manager Manual located here:
http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/Addfieldsfromexternaldatasources
Starting from page 129.
You need to be much more specific but in general, you do need to create a lookup file.
