I need to enrich my event data (web logs) with several other fields based on a value of one of the events fields. I plan to use a lookup that calls an script to go get the fields.
When I run the search again, containing the lookup, will it go and lookup events that were already looked up? Does splunk know to only enrich events that not yet enriched?
