In Splunk, a workflow action that returns an external IP lookup for a field named domain would typically use the GET method. This HTTP method is used to retrieve data from a specified resource, which is appropriate for looking up information based on the domain field.
References:
Splunk Docs: Define workflow actions
Splunk Answers: Workflow actions for external lookups