> ## Documentation Index
> Fetch the complete documentation index at: https://docs.chronosphere.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Create lookup tables for log data

When [filtering log data](/investigate/querying/query-logs), you want to quickly
retrieve results, especially when debugging an issue or responding to an incident. To
help provide more meaningful results, create lookup tables in a spreadsheet (in
CSV format) and upload them to Chronosphere Observability Platform. Lookup tables
store pre-calculated results or mappings between values, allowing for faster data
retrieval.

Use lookup tables to add context, normalize values, and enrich log data for improved
filtering. For example, you can enrich severity fields with explanations, map keys
like error codes to human-readable descriptions, and standardize inconsistent data.

Lookup tables help you apply consistent mappings and enrichments within queries,
without hard-coding large or repetitive mapping logic inline.

```mermaid actions={false} theme={null}
flowchart LR
Send["Send data"]
subgraph OP["Observability Platform"]
  Parse[Parse data]
  Normalize[Normalize data]
  Control[Control data]
  Format[Format data]
  Store[Store data]
end

Send --> Parse --> Normalize --> Control --> Format --> Store

click Parse "/control/shaping/shape-logs/parse-logs"
click Normalize "/control/shaping/shape-logs/normalize-logs"
click Control "/control/shaping/shape-logs/control-logs"

classDef stages fill:#2fbf71,stroke-width:2px,stroke:#2fbf71,color:#FFFFFF;
class Format stages
```

After uploading lookup tables, users can reference them in log
queries using the
[`lookup` function](/investigate/querying/query-logs/query-syntax#lookup).

## View lookup tables

To view lookup tables:

1. In the navigation menu, click **<Icon icon="shield-user" /> Go to Admin**
   and then select
   **<Icon icon="shapes" /> Control <span aria-label="and then">></span> Logs Lookup Tables**.
   All lookup tables are displayed.
2. To view a lookup table, click it in the list.

## Upload lookup tables

To upload a lookup table in Observability Platform, first create a spreadsheet in
CSV format. Each lookup table must be less than or equal to 10 MB. You can
add up to 1,000 lookup tables. To upload lookup tables that exceed 10 MB,
contact [Chronosphere Support](/support).

To upload lookup tables:

1. In the navigation menu, click **<Icon icon="shield-user" /> Go to Admin**
   and then select
   **<Icon icon="shapes" /> Control <span aria-label="and then">></span> Logs Lookup Tables**.
2. Click **Upload lookup table**.
3. In the **Upload lookup table** page, enter a name and description for your lookup
   table. Lookup table names must be unique.
4. Click **Upload CSV**, and then select the CSV file you want to upload from your
   local machine.
5. Click **Save** to upload your lookup table.

Your lookup table displays in the list of lookup tables, and can be referenced in log
queries using the
[`lookup` function](/investigate/querying/query-logs/query-syntax#lookup).

## Edit lookup tables

You can replace existing lookup tables by uploading a new lookup table. Replacing a
lookup table overwrites the existing table.

1. In the navigation menu, click **<Icon icon="shield-user" /> Go to Admin**
   and then select
   **<Icon icon="shapes" /> Control <span aria-label="and then">></span> Logs Lookup Tables**.
2. Click the lookup table you want to replace.
3. In the **Edit lookup table** page, click **Replace lookup table**.
4. On your local machine, select the CSV file you want to upload.
5. Click **Save** to upload your lookup table.

The lookup table is replaced with the one you selected.

## Delete lookup tables

To delete lookup tables:

1. In the navigation menu, click **<Icon icon="shield-user" /> Go to Admin**
   and then select
   **<Icon icon="shapes" /> Control <span aria-label="and then">></span> Logs Lookup Tables**.
2. Click the lookup table you want to delete.
3. In the **Edit lookup table** page, click **Delete lookup table**.
4. In the confirmation window, click **Delete** to delete the lookup table.

The lookup table is deleted from the list of lookup tables.