A fire/EMS analyst maps SPL jobs to commands: aggregate accelerated models, glue a time-bounded session, extract a buried field, calculate a flag, enrich from a table, or test without indexes. They need to enrich a rare dest IP with station owner and priority from the municipal asset CSV. Which command matches that job?
Select an answer to reveal the explanation.
Short Explanation
Match the tool to the chore: tstats counts, rex extracts, eval calculates, makeresults tests, lookup enriches. Stamping station owner and priority from a CSV onto a rare dest IP is enrichment — that is lookup, not a regex parlor trick.
Full Explanation
Security-analysis SPL selection follows the job: tstats for aggregations on accelerated models, transaction or stats first/last to glue a story, rex to extract, eval or foreach to calculate, lookup to enrich, and makeresults to test. Attaching station owner and priority from a municipal asset CSV is enrichment, so lookup is the matching command. transaction and rex do not read that CSV, and makeresults does not query a fire-station index.