match_type = <string>
* A comma and space-delimited list of <match_type>(<field_name>)
specification to allow for non-exact matching
* The available match_type values are WILDCARD, CIDR, and EXACT. Only fields
that should use WILDCARD or CIDR matching should be specified in this list.
* Default: EXACT
And if you want the lookup to happen automatically, that would be in props.conf (but also in the web).
So the simple lookup is in the lookups directory. The table definition (case sensitivity, wildcards, max matches, etc) is defined in transforms. And automatically running the lookup command for host/source/sourcetype is done in props.