Actually, Splunk isn't adding any info to the record - you can't update existing data. However, Splunk does cache the data it has looked up, therefore you see a good speed increase. ... View more