There appears to be data in the Summary lookup file that's not in the raw data in the seculert_records index - at least not according to the timestamps in both.
How is this lookup generated?
Seculert detects malware communications from devices in your organization to command and control hosts.
The individual raw communication records are reported into Splunk as events, while the aggregate incidents of infected devices are reported in a Summary lookup.
Using lookup solves challenge of updating information in an incident entity such as the time it was last seen or its status (open, closed).
Records and incidents are linked through an incident id.
summary are populated by scheduled searched.
lookups are populated with scheduled searches, or by scripts.
check for any search that contains "outputlookup"
There are two scheduled saved searches for this app - neither is set to output to a summary index or an output file that populates this particular file.