Question

To keep from overwriting existing fields with your Lookup you can use the ____________ clause.

Answer 1

in order to keep from overwritting exsisting fields with a lookup you can use a Geospatial clause or mabe CSV files. Scripts can help with it mabe to make it grammer orginazed if you want to keep your article more relavent and not override the system

Answer 2

I believe the answer is outputnew
The main difference between the output new and the output is that outputnew won't overrite the alredy existing description field.
If you don't put this clause, Splunk would adds all the field names and values to your events by through the lookup.