https://community.splunk.com/t5/Knowledge-Management/Provided-solution-Tip-to-reduce-large-CSV-lookups-replication/m-p/602972#M8878 <P>Find large CSV lookups above 400 mb (500 mb limit) :</P> <P>| rest splunk_server=* /servicesNS/-/-/data/transforms/lookups getsize=true f=size f=title f=type f=filename f=eai*|fields splunk_server filename title type size eai:appName<BR />|where isnotnull(size)|eval KB = round(size / 1024, 2)|fields - size<BR />| sort - KB<BR />| search KB&gt;400000</P> <P>&nbsp;</P> <P>Use this to reduce CSV lookup (example) :</P> <P>| inputlookup file.csv<BR />| eval time_epoch = strftime(_time,"%s")<BR />| where time_epoch&gt;relative_time(now(),"-100d@d")<BR />| outputlookup file.csv append=false</P> <P>&nbsp;</P> Thu, 23 Jun 2022 20:52:51 GMT splunkreal 2022-06-23T20:52:51Z https://community.splunk.com/t5/Knowledge-Management/Provided-solution-Tip-to-reduce-large-CSV-lookups-replication/m-p/602972#M8878 <P>Find large CSV lookups above 400 mb (500 mb limit) :</P> <P>| rest splunk_server=* /servicesNS/-/-/data/transforms/lookups getsize=true f=size f=title f=type f=filename f=eai*|fields splunk_server filename title type size eai:appName<BR />|where isnotnull(size)|eval KB = round(size / 1024, 2)|fields - size<BR />| sort - KB<BR />| search KB&gt;400000</P> <P>&nbsp;</P> <P>Use this to reduce CSV lookup (example) :</P> <P>| inputlookup file.csv<BR />| eval time_epoch = strftime(_time,"%s")<BR />| where time_epoch&gt;relative_time(now(),"-100d@d")<BR />| outputlookup file.csv append=false</P> <P>&nbsp;</P> Thu, 23 Jun 2022 20:52:51 GMT https://community.splunk.com/t5/Knowledge-Management/Provided-solution-Tip-to-reduce-large-CSV-lookups-replication/m-p/602972#M8878 splunkreal 2022-06-23T20:52:51Z