Splunk Interview Question

Lookups used case