https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-maintain-lookups/m-p/414745#M4957 <P>Splunk will let you know when the bundle size is too big, don't worry about that. I use automatic lookups whenever they make sense; when it is useful for everybody. If the data has a code and you can translate to a description (like HTTP response codes), then I set it up as automatic. If it is only for me, I just do it in my search manually. The only performance issues you may have is if you use the hacky <CODE>apply this to all sourcetypes</CODE> thing.</P> Sun, 01 Jul 2018 15:21:58 GMT woodcock 2018-07-01T15:21:58Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-maintain-lookups/m-p/414744#M4956 <P>I am analyzing our Splunk set-up and was going through the lookups, need suggestions on the best strategy to maintain lookups.<BR /> 1. bundle size <BR /> 2. switching over to manual lookups(instead of automatic lookups)<BR /> 3. Performance issues with automatic lookups</P> <P>Would appreciate if something else can be analyzed or taken care of.</P> <P>Thanks,<BR /> SB</P> Sat, 30 Jun 2018 06:18:04 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-maintain-lookups/m-p/414744#M4956 sidhantbhayana 2018-06-30T06:18:04Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-maintain-lookups/m-p/414745#M4957 <P>Splunk will let you know when the bundle size is too big, don't worry about that. I use automatic lookups whenever they make sense; when it is useful for everybody. If the data has a code and you can translate to a description (like HTTP response codes), then I set it up as automatic. If it is only for me, I just do it in my search manually. The only performance issues you may have is if you use the hacky <CODE>apply this to all sourcetypes</CODE> thing.</P> Sun, 01 Jul 2018 15:21:58 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-maintain-lookups/m-p/414745#M4957 woodcock 2018-07-01T15:21:58Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-maintain-lookups/m-p/414746#M4958 <P>Thanks @woodcock, agree to your response! I am planning to blacklist few lookups as the bundle size has reached ~1.5GB and it kind of becomes an issue in search peers. <BR /> Also, currently evaluating replacing lookups with kvstore, got to know that <CODE>Splunk creates a csv from the kvstore depending on the query and pushes the csv as part of bundle</CODE>. </P> <P>Looking forward to understand how kvstore will work and would it be better to replace lookups, considering the fact that the data is incremental.</P> <P>Thanks,<BR /> SB</P> Mon, 02 Jul 2018 05:40:54 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-maintain-lookups/m-p/414746#M4958 sidhantbhayana 2018-07-02T05:40:54Z