<span>in order to keep from overwritting exsisting fields with a lookup you can use a Geospatial clause or mabe CSV files. Scripts can help with it mabe to make it grammer orginazed if you want to keep your article more relavent and not override the system</span>
I believe the answer is <span>outputnew </span>The main difference between the output new and the output is that outputnew won't overrite the alredy existing description field. If you don't put this clause, <span>Splunk would adds all the field names and values to your events by through the lookup.</span>
