A reference dataset used to enrich events with additional information during querying. Lookup tables can contain mappings like IP addresses to geographic locations, user IDs to names, or error codes to descriptions. They enable data enrichment and correlation without modifying the original log data.