topic Re: Inputlookup vs. summary index performance in Monitoring Splunk

Inputlookup vs. summary index performance

jambajuice — Mon, 11 Apr 2011 13:32:47 GMT

If I have a bunch of events in a tabular format that I wish to search for various charts on a dashboard, is it faster to input the events with inputlookup or is it better to save them in a summary index and search the index?

Thx.

Craig

Re: Inputlookup vs. summary index performance

netwrkr — Tue, 12 Apr 2011 01:48:53 GMT

I would think using a summary index would always be faster.

Re: Inputlookup vs. summary index performance

sideview — Tue, 12 Apr 2011 12:34:25 GMT

Depends on the size of the lookup table. If it's less than 10MB, it's almost certainly faster to use inputlookup because it'll be sitting in memory already.

http://answers.splunk.com/questions/8326/are-lookup-tables-indexed

However bear in mind that you get all sorts of extra flexibility when you have summary indexing going. It's not uncommon for a lookup solution to get replaced down the road by a summary index solution when you need that flexibility. Like when the values start changing over time and you need to report on the changes.