Data enrichment - ingestion time lookup?

[pezcrap]

I have some event data that has a user-id associated with it.

I also have a separate datastore that contains some data about each user (team, location etc etc)

I would like to be able to run splunk queries that use that data ( for eg "show me events from team A")

At first glance it looks like Splunks 'lookup' capability would be ideal, however it seems that this is resolved at search time.

Unfortunately the data in the seperate datastore is mutable. For example user 1234 might change teams from team A to team B. When this occurs I do not want his old events from when he was in team A to show up in a search for team B.

To avoid this I would prefer to enrich the data as it is ingested so that the data associated with each event remains immutable.

Does Splunk provide any support for this approach?

[sibbsnb]

Input lookup is your better bet if your data is changing and you want analytics to be accurate. If you are ok for some variance of errors and the data gets purged, you can do it at ingest time which is efficient.

Splunk cannot change the data once ingested unless you re-ingest it.