topic Re: can we increase lookup table maximum matches to 2000? in Splunk Search

can we increase lookup table maximum matches to 2000?

rajchi — Fri, 15 Jul 2016 13:27:09 GMT

Lookup table max match can be 1 to 1000, I want to increase it to 2000. Is it possible? When I increase the max_matches in limits.conf then it is not taking, is there any other way to achieve this?

Re: can we increase lookup table maximum matches to 2000?

woodcock — Fri, 15 Jul 2016 13:47:51 GMT

First, create a lookup definition (from Settings -> Lookups -> Lookup Definitions) for you lookup file, then give it same sharing permissions as the lookup file, then in the Advanced options set the value to 2000.

Re: can we increase lookup table maximum matches to 2000?

rajchi — Fri, 15 Jul 2016 14:18:32 GMT

Thanks for your reply, but it is not working. You can't increase the value of maximum matches above 1000 from UI lookup definition. It gives error from UI if you will try to increase it above 1000, I did try from limits.conf as well but it is not working.

Re: can we increase lookup table maximum matches to 2000?

somesoni2 — Fri, 15 Jul 2016 15:20:26 GMT

The max allowed value is 1000. See the documentation for lookup definition (transforms.conf
https://docs.splunk.com/Documentation/Splunk/6.4.1/Admin/Transformsconf#Lookup_tables

max_matches = <integer>
* The maximum number of possible matches for each input lookup value
  (range 1 - 1000)

Re: can we increase lookup table maximum matches to 2000?

woodcock — Fri, 15 Jul 2016 15:35:04 GMT

If the built-in lookup is limited to 1000, then you will have to create your own scripted lookup:

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Configureexternallookups

Re: can we increase lookup table maximum matches to 2000?

rajchi — Fri, 15 Jul 2016 15:36:22 GMT

Thanks for your reply, so there is no way I can match more than 1000 using lookup?

Re: can we increase lookup table maximum matches to 2000?

somesoni2 — Fri, 15 Jul 2016 15:49:06 GMT

I believe no

Re: can we increase lookup table maximum matches to 2000?

rajchi — Fri, 15 Jul 2016 16:44:06 GMT

The maximum limit for "external lookup" is also 1000 for maximum matches. Please let me know if someone has done this before or if someone can confirm it is not possible at all.

Re: can we increase lookup table maximum matches to 2000?

ConsoleBotTryPC — Tue, 21 Nov 2023 17:46:45 GMT

Were you able to find a solution for it?