Splunk interview question

Lookups used case