topic Re: Best Practice for Automatic Lookups in Splunk Enterprise

Best Practice for Automatic Lookups

jaburke1 — Wed, 15 Nov 2023 12:11:19 GMT

Is there a suggested size of lookup that would be the maximum size of a lookup that should be used for an automatic lookup?

Such as if your lookup exceeds more than x rows it would best not to use with an automatic lookup?

Re: Best Practice for Automatic Lookups

richgalloway — Fri, 17 Nov 2023 13:40:54 GMT

I'm not sure there are best practices around automatic lookups. There are some for lookups in general, however. Monitor lookup size (in bytes) to make sure they don't cause the knowledge bundle to become too large (2GB). Large lookups should be blocked from the bundle or converted to KVStore.

Re: Best Practice for Automatic Lookups

jaburke1 — Fri, 17 Nov 2023 13:52:40 GMT

Thanks Rich! Is it a bad practice to use a KVStore for automatic lookups since they can get very large?

Re: Best Practice for Automatic Lookups

richgalloway — Fri, 17 Nov 2023 15:33:12 GMT

I wouldn't say that at all. One of the features of KVStore is to replace large lookup files.