In automatic lookup definitions, the _____ fields are those that are not in the event data.

In Splunk, a lookup is used to enrich event data by adding fields from an external source, such as a CSV file. The lookup configuration defines which fields from the lookup source (the output fields) should be added to the events. The process matches one or more fields that already exist in the event data (the input fields) with corresponding fields in the lookup table. Upon a successful match, the values from the specified output fields are appended to the event. Therefore, the output fields are the ones not originally present in the event data.

A. input: Input fields are the fields that are in the event data and are used as the basis for matching against the lookup table.

1. Splunk Enterprise Documentation. Knowledge Manager Manual, "Define a field lookup for a lookup table". In the section "Configure the lookup definition," the manual states: "The lookup output fields are fields in your lookup table that you want to add to your events." This confirms that output fields are added to, and thus not originally in, the event data.

2. Splunk Enterprise Documentation. Search Manual, "About lookups". This section explains the concept: "Splunk software uses one or more fields that are in your events (the 'input' fields) to look up and find a match in the lookup dataset... When a match is found, Splunk software outputs corresponding field values from the lookup dataset to your events (the 'output' fields)."