diff --git a/src/Val.cc b/src/Val.cc
index a7c0cfad6a..b2b3d4afb6 100644
--- a/src/Val.cc
+++ b/src/Val.cc
@@ -577,7 +577,7 @@ static void BuildJSON(threading::formatter::JSON::NullDoubleWriter& writer, Val*
 
 			for ( auto i = 0; i < rt->NumFields(); ++i )
 				{
-				Val* value = rval->LookupWithDefault(i);
+				auto value = rval->LookupWithDefault(i);
 
 				if ( value && ( ! only_loggable || rt->FieldHasAttr(i, ATTR_LOG) ) )
 					{
@@ -595,10 +595,8 @@ static void BuildJSON(threading::formatter::JSON::NullDoubleWriter& writer, Val*
 					else
 						key_str = field_name;
 
-					BuildJSON(writer, value, only_loggable, re, key_str);
+					BuildJSON(writer, value.get(), only_loggable, re, key_str);
 					}
-
-				Unref(value);
 				}
 
 			writer.EndObject();
@@ -2611,14 +2609,14 @@ Val* RecordVal::Lookup(int field) const
 	return (*AsRecord())[field];
 	}
 
-Val* RecordVal::LookupWithDefault(int field) const
+IntrusivePtr<Val> RecordVal::LookupWithDefault(int field) const
 	{
 	Val* val = (*AsRecord())[field];
 
 	if ( val )
-		return val->Ref();
+		return {NewRef{}, val};
 
-	return Type()->AsRecordType()->FieldDefault(field).release();
+	return Type()->AsRecordType()->FieldDefault(field);
 	}
 
 void RecordVal::ResizeParseTimeRecords()
@@ -2644,14 +2642,14 @@ void RecordVal::ResizeParseTimeRecords()
 	parse_time_records.clear();
 	}
 
-Val* RecordVal::Lookup(const char* field, bool with_default) const
+IntrusivePtr<Val> RecordVal::Lookup(const char* field, bool with_default) const
 	{
 	int idx = Type()->AsRecordType()->FieldOffset(field);
 
 	if ( idx < 0 )
 		reporter->InternalError("missing record field: %s", field);
 
-	return with_default ? LookupWithDefault(idx) : Lookup(idx);
+	return with_default ? LookupWithDefault(idx) : IntrusivePtr{NewRef{}, Lookup(idx)};
 	}
 
 IntrusivePtr<RecordVal> RecordVal::CoerceTo(const RecordType* t, Val* aggr, bool allow_orphaning) const
diff --git a/src/Val.h b/src/Val.h
index 9a97227b9d..74d31b1f6a 100644
--- a/src/Val.h
+++ b/src/Val.h
@@ -865,7 +865,7 @@ public:
 	void Assign(int field, IntrusivePtr<Val> new_val);
 	void Assign(int field, Val* new_val);
 	Val* Lookup(int field) const;	// Does not Ref() value.
-	Val* LookupWithDefault(int field) const;	// Does Ref() value.
+	IntrusivePtr<Val> LookupWithDefault(int field) const;
 
 	/**
 	 * Looks up the value of a field by field name.  If the field doesn't
@@ -873,10 +873,9 @@ public:
 	 * @param field name of field to lookup.
 	 * @param with_default whether to rely on field's &default attribute when
 	 * the field has yet to be initialized.
-	 * @return the value in field \a field.  It is Ref()'d only if
-	 * \a with_default is true.
+	 * @return the value in field \a field.
 	 */
-	Val* Lookup(const char* field, bool with_default = false) const;
+	IntrusivePtr<Val> Lookup(const char* field, bool with_default = false) const;
 
 	void Describe(ODesc* d) const override;
 
diff --git a/src/broker/Data.cc b/src/broker/Data.cc
index ed2d6345a9..f8de5c4415 100644
--- a/src/broker/Data.cc
+++ b/src/broker/Data.cc
@@ -997,8 +997,7 @@ broker::expected<broker::data> bro_broker::val_to_data(const Val* v)
 				continue;
 				}
 
-			auto item = val_to_data(item_val);
-			Unref(item_val);
+			auto item = val_to_data(item_val.get());
 
 			if ( ! item )
 				return broker::ec::invalid_data;
diff --git a/src/file_analysis/File.cc b/src/file_analysis/File.cc
index 569dcaca32..6ba35ea3a3 100644
--- a/src/file_analysis/File.cc
+++ b/src/file_analysis/File.cc
@@ -163,18 +163,14 @@ void File::RaiseFileOverNewConnection(Connection* conn, bool is_orig)
 
 uint64_t File::LookupFieldDefaultCount(int idx) const
 	{
-	Val* v = val->LookupWithDefault(idx);
-	uint64_t rval = v->AsCount();
-	Unref(v);
-	return rval;
+	auto v = val->LookupWithDefault(idx);
+	return v->AsCount();
 	}
 
 double File::LookupFieldDefaultInterval(int idx) const
 	{
-	Val* v = val->LookupWithDefault(idx);
-	double rval = v->AsInterval();
-	Unref(v);
-	return rval;
+	auto v = val->LookupWithDefault(idx);
+	return v->AsInterval();
 	}
 
 int File::Idx(const string& field, const RecordType* type)
diff --git a/src/file_analysis/analyzer/data_event/DataEvent.cc b/src/file_analysis/analyzer/data_event/DataEvent.cc
index 7614127ea7..80e2de25e7 100644
--- a/src/file_analysis/analyzer/data_event/DataEvent.cc
+++ b/src/file_analysis/analyzer/data_event/DataEvent.cc
@@ -21,8 +21,8 @@ DataEvent::DataEvent(RecordVal* args, File* file,
 
 file_analysis::Analyzer* DataEvent::Instantiate(RecordVal* args, File* file)
 	{
-	Val* chunk_val = args->Lookup("chunk_event");
-	Val* stream_val = args->Lookup("stream_event");
+	auto chunk_val = args->Lookup("chunk_event");
+	auto stream_val = args->Lookup("stream_event");
 
 	if ( ! chunk_val && ! stream_val ) return 0;
 
diff --git a/src/file_analysis/analyzer/extract/Extract.cc b/src/file_analysis/analyzer/extract/Extract.cc
index d023036930..69ab2f16c7 100644
--- a/src/file_analysis/analyzer/extract/Extract.cc
+++ b/src/file_analysis/analyzer/extract/Extract.cc
@@ -32,9 +32,9 @@ Extract::~Extract()
 		safe_close(fd);
 	}
 
-static Val* get_extract_field_val(RecordVal* args, const char* name)
+static IntrusivePtr<Val> get_extract_field_val(RecordVal* args, const char* name)
 	{
-	Val* rval = args->Lookup(name);
+	auto rval = args->Lookup(name);
 
 	if ( ! rval )
 		reporter->Error("File extraction analyzer missing arg field: %s", name);
@@ -44,8 +44,8 @@ static Val* get_extract_field_val(RecordVal* args, const char* name)
 
 file_analysis::Analyzer* Extract::Instantiate(RecordVal* args, File* file)
 	{
-	Val* fname = get_extract_field_val(args, "extract_filename");
-	Val* limit = get_extract_field_val(args, "extract_limit");
+	auto fname = get_extract_field_val(args, "extract_filename");
+	auto limit = get_extract_field_val(args, "extract_limit");
 
 	if ( ! fname || ! limit )
 		return 0;
diff --git a/src/file_analysis/analyzer/x509/OCSP.cc b/src/file_analysis/analyzer/x509/OCSP.cc
index dcd82bff60..30b7e4283c 100644
--- a/src/file_analysis/analyzer/x509/OCSP.cc
+++ b/src/file_analysis/analyzer/x509/OCSP.cc
@@ -32,9 +32,9 @@ using namespace file_analysis;
 
 #define OCSP_STRING_BUF_SIZE 2048
 
-static Val* get_ocsp_type(RecordVal* args, const char* name)
+static IntrusivePtr<Val> get_ocsp_type(RecordVal* args, const char* name)
 	{
-	Val* rval = args->Lookup(name);
+	auto rval = args->Lookup(name);
 
 	if ( ! rval )
 		reporter->Error("File extraction analyzer missing arg field: %s", name);
diff --git a/src/input/Manager.cc b/src/input/Manager.cc
index 2b57130fbf..04e5b1fe04 100644
--- a/src/input/Manager.cc
+++ b/src/input/Manager.cc
@@ -239,9 +239,7 @@ bool Manager::CreateStream(Stream* info, RecordVal* description)
 		return false;
 		}
 
-	Val* name_val = description->Lookup("name", true);
-	string name = name_val->AsString()->CheckString();
-	Unref(name_val);
+	string name = description->Lookup("name", true)->AsString()->CheckString();
 
 	Stream *i = FindStream(name);
 	if ( i != 0 )
@@ -251,20 +249,17 @@ bool Manager::CreateStream(Stream* info, RecordVal* description)
 		return false;
 		}
 
-	EnumVal* reader = description->Lookup("reader", true)->AsEnumVal();
+	EnumVal* reader = description->Lookup("reader", true).release()->AsEnumVal();
 
 	// get the source ...
-	Val* sourceval = description->Lookup("source", true);
-	assert ( sourceval != 0 );
-	const BroString* bsource = sourceval->AsString();
+	const BroString* bsource = description->Lookup("source", true)->AsString();
 	string source((const char*) bsource->Bytes(), bsource->Len());
-	Unref(sourceval);
 
 	ReaderBackend::ReaderInfo rinfo;
 	rinfo.source = copy_string(source.c_str());
 	rinfo.name = copy_string(name.c_str());
 
-	EnumVal* mode = description->Lookup("mode", true)->AsEnumVal();
+	auto mode = description->Lookup("mode", true)->AsEnumVal();
 	switch ( mode->InternalInt() )
 		{
 		case 0:
@@ -281,14 +276,11 @@ bool Manager::CreateStream(Stream* info, RecordVal* description)
 
 		default:
 			reporter->InternalWarning("unknown input reader mode");
-			Unref(mode);
 			return false;
 		}
 
-	Unref(mode);
-
-	Val* config = description->Lookup("config", true);
-	info->config = config->AsTableVal(); // ref'd by LookupWithDefault
+	auto config = description->Lookup("config", true);
+	info->config = config.release()->AsTableVal();
 
 		{
 		// create config mapping in ReaderInfo. Has to be done before the construction of reader_obj.
@@ -335,19 +327,13 @@ bool Manager::CreateEventStream(RecordVal* fval)
 		return false;
 		}
 
-	Val* name_val = fval->Lookup("name", true);
-	string stream_name = name_val->AsString()->CheckString();
-	Unref(name_val);
+	string stream_name = fval->Lookup("name", true)->AsString()->CheckString();
 
-	Val* fields_val = fval->Lookup("fields", true);
-	RecordType *fields = fields_val->AsType()->AsTypeType()->Type()->AsRecordType();
-	Unref(fields_val);
+	RecordType *fields = fval->Lookup("fields", true)->AsType()->AsTypeType()->Type()->AsRecordType();
 
-	Val *want_record = fval->Lookup("want_record", true);
+	auto want_record = fval->Lookup("want_record", true);
 
-	Val* event_val = fval->Lookup("ev", true);
-	Func* event = event_val->AsFunc();
-	Unref(event_val);
+	Func* event = fval->Lookup("ev", true)->AsFunc();
 
 	FuncType* etype = event->FType()->AsFuncType();
 
@@ -435,9 +421,8 @@ bool Manager::CreateEventStream(RecordVal* fval)
 	else
 		assert(false);
 
-	Val* error_event_val = fval->Lookup("error_ev", true);
+	auto error_event_val = fval->Lookup("error_ev", true);
 	Func* error_event = error_event_val ? error_event_val->AsFunc() : nullptr;
-	Unref(error_event_val);
 
 	if ( ! CheckErrorEventTypes(stream_name, error_event, false) )
 		return false;
@@ -472,7 +457,6 @@ bool Manager::CreateEventStream(RecordVal* fval)
 	stream->event = event_registry->Lookup(event->Name());
 	stream->error_event = error_event ? event_registry->Lookup(error_event->Name()) : nullptr;
 	stream->want_record = ( want_record->InternalInt() == 1 );
-	Unref(want_record); // ref'd by lookupwithdefault
 
 	assert(stream->reader);
 
@@ -495,26 +479,19 @@ bool Manager::CreateTableStream(RecordVal* fval)
 		return false;
 		}
 
-	Val* name_val = fval->Lookup("name", true);
-	string stream_name = name_val->AsString()->CheckString();
-	Unref(name_val);
+	string stream_name = fval->Lookup("name", true)->AsString()->CheckString();
 
-	Val* pred = fval->Lookup("pred", true);
+	auto pred = fval->Lookup("pred", true);
 
-	Val* idx_val = fval->Lookup("idx", true);
-	RecordType *idx = idx_val->AsType()->AsTypeType()->Type()->AsRecordType();
-	Unref(idx_val);
+	RecordType *idx = fval->Lookup("idx", true)->AsType()->AsTypeType()->Type()->AsRecordType();
 
 	RecordType *val = 0;
 
-	Val* val_val = fval->Lookup("val", true);
+	auto val_val = fval->Lookup("val", true);
 	if ( val_val )
-		{
 		val = val_val->AsType()->AsTypeType()->Type()->Ref()->AsRecordType();
-		Unref(val_val);
-		}
 
-	TableVal *dst = fval->Lookup("destination", true)->AsTableVal();
+	TableVal *dst = fval->Lookup("destination", true).release()->AsTableVal();
 
 	// check if index fields match table description
 	int num = idx->NumFields();
@@ -549,7 +526,7 @@ bool Manager::CreateTableStream(RecordVal* fval)
 		return false;
 		}
 
-	Val *want_record = fval->Lookup("want_record", true);
+	auto want_record = fval->Lookup("want_record", true);
 
 	if ( val )
 		{
@@ -582,9 +559,8 @@ bool Manager::CreateTableStream(RecordVal* fval)
 			}
 		}
 
-	Val* event_val = fval->Lookup("ev", true);
+	auto event_val = fval->Lookup("ev", true);
 	Func* event = event_val ? event_val->AsFunc() : 0;
-	Unref(event_val);
 
 	if ( event )
 		{
@@ -656,9 +632,8 @@ bool Manager::CreateTableStream(RecordVal* fval)
 		assert(want_record->InternalInt() == 1 || want_record->InternalInt() == 0);
 		}
 
-	Val* error_event_val = fval->Lookup("error_ev", true);
+	auto error_event_val = fval->Lookup("error_ev", true);
 	Func* error_event = error_event_val ? error_event_val->AsFunc() : nullptr;
-	Unref(error_event_val);
 
 	if ( ! CheckErrorEventTypes(stream_name, error_event, true) )
 		return false;
@@ -720,9 +695,6 @@ bool Manager::CreateTableStream(RecordVal* fval)
 	stream->lastDict->SetDeleteFunc(input_hash_delete_func);
 	stream->want_record = ( want_record->InternalInt() == 1 );
 
-	Unref(want_record); // ref'd by lookupwithdefault
-	Unref(pred);
-
 	assert(stream->reader);
 	stream->reader->Init(fieldsV.size(), fields );
 
@@ -1034,7 +1006,7 @@ bool Manager::ForceUpdate(const string &name)
 
 Val* Manager::RecordValToIndexVal(RecordVal *r) const
 	{
-	Val* idxval;
+	IntrusivePtr<Val> idxval;
 
 	RecordType *type = r->Type()->AsRecordType();
 
@@ -1045,15 +1017,15 @@ Val* Manager::RecordValToIndexVal(RecordVal *r) const
 
 	else
 		{
-		ListVal *l = new ListVal(TYPE_ANY);
+		auto l = make_intrusive<ListVal>(TYPE_ANY);
 		for ( int j = 0 ; j < num_fields; j++ )
-			l->Append(r->LookupWithDefault(j));
+			l->Append(r->LookupWithDefault(j).release());
 
-		idxval = l;
+		idxval = std::move(l);
 		}
 
 
-	return idxval;
+	return idxval.release();
 	}
 
 
diff --git a/src/logging/Manager.cc b/src/logging/Manager.cc
index 781e9dcd5c..06962bfaf0 100644
--- a/src/logging/Manager.cc
+++ b/src/logging/Manager.cc
@@ -263,7 +263,7 @@ bool Manager::CreateStream(EnumVal* id, RecordVal* sval)
 		return false;
 		}
 
-	Val* event_val = sval->Lookup("ev");
+	auto event_val = sval->Lookup("ev");
 	Func* event = event_val ? event_val->AsFunc() : 0;
 
 	if ( event )
@@ -548,18 +548,18 @@ bool Manager::AddFilter(EnumVal* id, RecordVal* fval)
 
 	// Create a new Filter instance.
 
-	Val* name = fval->Lookup("name", true);
-	Val* pred = fval->Lookup("pred", true);
-	Val* path_func = fval->Lookup("path_func", true);
-	Val* log_local = fval->Lookup("log_local", true);
-	Val* log_remote = fval->Lookup("log_remote", true);
-	Val* interv = fval->Lookup("interv", true);
-	Val* postprocessor = fval->Lookup("postprocessor", true);
-	Val* config = fval->Lookup("config", true);
-	Val* field_name_map = fval->Lookup("field_name_map", true);
-	Val* scope_sep = fval->Lookup("scope_sep", true);
-	Val* ext_prefix = fval->Lookup("ext_prefix", true);
-	Val* ext_func = fval->Lookup("ext_func", true);
+	auto name = fval->Lookup("name", true);
+	auto pred = fval->Lookup("pred", true);
+	auto path_func = fval->Lookup("path_func", true);
+	auto log_local = fval->Lookup("log_local", true);
+	auto log_remote = fval->Lookup("log_remote", true);
+	auto interv = fval->Lookup("interv", true);
+	auto postprocessor = fval->Lookup("postprocessor", true);
+	auto config = fval->Lookup("config", true);
+	auto field_name_map = fval->Lookup("field_name_map", true);
+	auto scope_sep = fval->Lookup("scope_sep", true);
+	auto ext_prefix = fval->Lookup("ext_prefix", true);
+	auto ext_func = fval->Lookup("ext_func", true);
 
 	Filter* filter = new Filter;
 	filter->fval = fval->Ref();
@@ -578,23 +578,10 @@ bool Manager::AddFilter(EnumVal* id, RecordVal* fval)
 	filter->ext_prefix = ext_prefix->AsString()->CheckString();
 	filter->ext_func = ext_func ? ext_func->AsFunc() : 0;
 
-	Unref(name);
-	Unref(pred);
-	Unref(path_func);
-	Unref(log_local);
-	Unref(log_remote);
-	Unref(interv);
-	Unref(postprocessor);
-	Unref(config);
-	Unref(field_name_map);
-	Unref(scope_sep);
-	Unref(ext_prefix);
-	Unref(ext_func);
-
 	// Build the list of fields that the filter wants included, including
 	// potentially rolling out fields.
-	Val* include = fval->Lookup("include");
-	Val* exclude = fval->Lookup("exclude");
+	auto include = fval->Lookup("include");
+	auto exclude = fval->Lookup("exclude");
 
 	filter->num_ext_fields = 0;
 	if ( filter->ext_func )
@@ -619,8 +606,8 @@ bool Manager::AddFilter(EnumVal* id, RecordVal* fval)
 	filter->num_fields = 0;
 	filter->fields = 0;
 	if ( ! TraverseRecord(stream, filter, stream->columns,
-			      include ? include->AsTableVal() : 0,
-			      exclude ? exclude->AsTableVal() : 0,
+			      include ? include.release()->AsTableVal() : 0,
+			      exclude ? exclude.release()->AsTableVal() : 0,
 			      "", list<int>()) )
 		{
 		delete filter;
@@ -628,12 +615,12 @@ bool Manager::AddFilter(EnumVal* id, RecordVal* fval)
 		}
 
 	// Get the path for the filter.
-	Val* path_val = fval->Lookup("path");
+	auto path_val = fval->Lookup("path");
 
 	if ( path_val )
 		{
 		filter->path = path_val->AsString()->CheckString();
-		filter->path_val = path_val->Ref();
+		filter->path_val = path_val.release();
 		}
 
 	else