Lookup File Editor: Is there any workaround other than reducing the lookup file size?

AHA-0114 — Tue, 08 Mar 2022 17:53:33 GMT

I try to edit lookup file through the lookup file editor, but below message is shown.
The file is too big to be edited (must be less than 10 MB)
Is there any workaround other than reducing the lookup file size?

Re: Question about Lookup File Editor

gcusello — Tue, 08 Mar 2022 08:19:05 GMT

Hi @AHA-0114,

there are two solutions:

modify "ingest_max_memtable_bytes parameter in limits.conf (default 10 M) (for more infos see at https://docs.splunk.com/Documentation/Splunk/8.2.5/Admin/Limitsconf),
divide your lookups.

If possible the second is better so you don't modify standard configurations, otherwise, you can use the first.

Ciao.

Giuseppe

topic Re: Question about Lookup File Editor in Knowledge Management

Lookup File Editor: Is there any workaround other than reducing the lookup file size?

Re: Question about Lookup File Editor