https://community.splunk.com/t5/Splunk-Search/Is-the-automatic-lookup-table-used-by-the-indexer/m-p/402330#M173722 <P>Thanks for the Cribl info, @skoelpin. I'll check it out.</P> Thu, 17 Jan 2019 13:48:42 GMT rxdeleon 2019-01-17T13:48:42Z https://community.splunk.com/t5/Splunk-Search/Is-the-automatic-lookup-table-used-by-the-indexer/m-p/402323#M173715 <P>When an automatic lookup table is defined, is that used by the indexer to add the new fields or is it the search head that does that?</P> Thu, 10 Jan 2019 17:21:27 GMT https://community.splunk.com/t5/Splunk-Search/Is-the-automatic-lookup-table-used-by-the-indexer/m-p/402323#M173715 rxdeleon 2019-01-10T17:21:27Z https://community.splunk.com/t5/Splunk-Search/Is-the-automatic-lookup-table-used-by-the-indexer/m-p/402324#M173716 <P>It's the search head. The data is already indexed on the indexer so it would be a search time function</P> Thu, 10 Jan 2019 17:30:49 GMT https://community.splunk.com/t5/Splunk-Search/Is-the-automatic-lookup-table-used-by-the-indexer/m-p/402324#M173716 skoelpin 2019-01-10T17:30:49Z https://community.splunk.com/t5/Splunk-Search/Is-the-automatic-lookup-table-used-by-the-indexer/m-p/402325#M173717 <P>Thanks, skoelpin, for the quick reply. If that's the case, does that mean that the raw data found by the indexer would all be shipped to the search head? And that's where the lookup table would be applied?</P> Thu, 10 Jan 2019 17:51:19 GMT https://community.splunk.com/t5/Splunk-Search/Is-the-automatic-lookup-table-used-by-the-indexer/m-p/402325#M173717 rxdeleon 2019-01-10T17:51:19Z https://community.splunk.com/t5/Splunk-Search/Is-the-automatic-lookup-table-used-by-the-indexer/m-p/402326#M173718 <P>Partially correct. The SH will search the data on the indexer, the indexer will not ship its data to the SH</P> <P>Data lives on the indexer and when a scheduled/ad-hoc search kicks off on the SH, the SH will search the data on the indexers and the automatic lookup logic will be applied at search time. A good way to think about this is, say you create an automatic lookup and want to change it after a day. You can easily change it because it's done on the fly at search time without baking any rules onto the indexers </P> Thu, 10 Jan 2019 17:57:30 GMT https://community.splunk.com/t5/Splunk-Search/Is-the-automatic-lookup-table-used-by-the-indexer/m-p/402326#M173718 skoelpin 2019-01-10T17:57:30Z https://community.splunk.com/t5/Splunk-Search/Is-the-automatic-lookup-table-used-by-the-indexer/m-p/402327#M173719 <P>@rxdeleon please accept the answer if I answered your question </P> Mon, 14 Jan 2019 18:01:20 GMT https://community.splunk.com/t5/Splunk-Search/Is-the-automatic-lookup-table-used-by-the-indexer/m-p/402327#M173719 skoelpin 2019-01-14T18:01:20Z https://community.splunk.com/t5/Splunk-Search/Is-the-automatic-lookup-table-used-by-the-indexer/m-p/402328#M173720 <P>@skoelpin, I understand that the automatic lookup logic will be applied at search time. But which component does that? Is it the search head or the indexer? If it's the search head, then that means the search results, no matter how big, would be sent to the search head where the automatic lookup logic would be applied.</P> <P>I would wish that it's the indexer that does it so that extracted fields could be used to filter out irrelevant events to minimize data being sent back to the search head (for performance reasons).</P> Wed, 16 Jan 2019 22:06:07 GMT https://community.splunk.com/t5/Splunk-Search/Is-the-automatic-lookup-table-used-by-the-indexer/m-p/402328#M173720 rxdeleon 2019-01-16T22:06:07Z https://community.splunk.com/t5/Splunk-Search/Is-the-automatic-lookup-table-used-by-the-indexer/m-p/402329#M173721 <P>It's the search head. Lookups have always been a bottleneck which is why I always tell customers that you should use a <CODE>stats</CODE> before the <CODE>lookup</CODE>. </P> <P>For index time lookups, you should check out Cribl. It integrates directly with Splunk! I had a long conversation with their CEO @clintsharp at CONF and was pretty impressed with the features it has. </P> <P><A href="https://blog.cribl.io/2018/09/17/enriching-data-in-motion-with-ingest-time-lookups/">https://blog.cribl.io/2018/09/17/enriching-data-in-motion-with-ingest-time-lookups/</A></P> Wed, 16 Jan 2019 23:23:06 GMT https://community.splunk.com/t5/Splunk-Search/Is-the-automatic-lookup-table-used-by-the-indexer/m-p/402329#M173721 skoelpin 2019-01-16T23:23:06Z https://community.splunk.com/t5/Splunk-Search/Is-the-automatic-lookup-table-used-by-the-indexer/m-p/402330#M173722 <P>Thanks for the Cribl info, @skoelpin. I'll check it out.</P> Thu, 17 Jan 2019 13:48:42 GMT https://community.splunk.com/t5/Splunk-Search/Is-the-automatic-lookup-table-used-by-the-indexer/m-p/402330#M173722 rxdeleon 2019-01-17T13:48:42Z