A fire/EMS analyst maps SPL jobs to commands: aggregate accelerated models, glue a time-bounded session, extract a buried field, calculate a flag, enrich from a table, or test without indexes. They need to enrich a rare dest IP with station owner and priority from the municipal asset CSV. Which command matches that job?

Security-analysis SPL selection follows the job: tstats aggregates accelerated models, transaction or stats first/last glues a time-bounded story, rex extracts buried fields, eval or foreach calculates flags, lookup enriches from a table, and makeresults tests without indexes. Attaching fire-station owner and priority from a municipal asset CSV onto a rare dest IP is enrichment, so lookup is the matching command. That mapping discipline is what the exam tests—not memorizing every SPL flag in isolation from the analytical task. transaction groups sessions; it does not load asset owner and priority from a CSV inventory. rex extracting digits from an IP cannot produce true owner or business unit from the municipal asset list. makeresults does not query a fire-station index or return inventory attributes, so it cannot enrich the rare destination. Exam caveat: if Asset and Identity already supplies those fields in Enterprise Security, prefer the normalized enrichment path; ad-hoc lookup still matters for SPL hunts outside automatic A&I. Operational check: lookup the rare dest against the municipal asset CSV, confirm station owner and priority populate, and annotate the team cheat-sheet so enrich jobs map to lookup rather than rex or transaction.