You can add additional fields to extend the capability of the lookups in ES. If/when you do this you will also want to do a couple additional things using the rough outline provided below: 1. Configure additional Fields in lookups and schedule lookup creation - http://docs.splunk.com/Documentation/ES/4.7.3/Admin/Createsearchdrivenlookups 2. Configure Correlations searches to leverage lookup and scheduled Correlations Searches to create Notable Events - http://docs.splunk.com/Documentation/ES/4.7.3/Admin/Configurecorrelationsearches ... View more