Lookup File

When a call is recorded, the collector captures the caller’s IP subnet. On its own, that subnet has no human-readable meaning. A lookup file maps each subnet to a site name, country, and geographic coordinates, so your dashboards can show which office or location a call originated from.

This replaces the deprecated ms_teams_site_definition feature. Instead of bundling the mapping inside the collector, you define it directly on your backend — it is loaded once, stays up to date, and never adds overhead to collection cycles.

Data Model

Your lookup table must contain these columns:

Column	Description
`subnet`	IP subnet in CIDR notation (e.g. `192.168.1.0/24`)
`site`	Human-readable site name (e.g. `Paris HQ`)
`country`	Country name or ISO code
`lon`	Longitude (decimal degrees)
`lat`	Latitude (decimal degrees)

Download lookup.csv

or copy the template below:

subnet,site,country,lon,lat
10.64.1.0/24,Paris HQ,FR,2.3522,48.8566
10.64.2.0/24,London HQ,GB,-0.1276,51.5074
10.64.3.0/24,New York HQ,US,-74.0060,40.7128

Dynatrace Grail supports Lookup data. You can create a lookup table from a CSV file and reference it in DQL queries or OpenPipeline processors.

In the Dynatrace UI, go to Settings → Lookup data.
Create a new lookup table at the path /lookups/ms_teams/sites — this exact path is required by the MS Teams Observability app.
Upload a CSV file with the columns: subnet, site, country, lon, lat.

The path used to load the table in DQL is:

/lookups/ms_teams/sites

Splunk supports lookup tables that can be applied automatically at search time.

In Splunk, go to Settings → Lookups → Lookup table files and upload a CSV file with columns: subnet, site, country, lon, lat.
Define a lookup definition under Settings → Lookups → Lookup definitions pointing to your file.
Optionally configure an Automatic lookup on the ms_teams index so the enrichment is applied transparently:

index=ms_teams
| lookup ms_teams_sites subnet AS caller_subnet OUTPUT site, country, lon, lat