https://community.splunk.com/t5/Splunk-Search/Are-lookup-tables-indexed/m-p/77100#M19506 <P>So if the lookup table file size is less than this magic number, does Splunk simply look through the table at search time?</P> Tue, 26 Oct 2010 00:58:27 GMT carmackd 2010-10-26T00:58:27Z https://community.splunk.com/t5/Splunk-Search/Are-lookup-tables-indexed/m-p/77098#M19504 <P>So how does splunk handle static lookup tables, are they indexed?</P> <P>max_memtable_bytes = <BR /> * maximum size of static lookup file to use a in-memory index for<BR /> * Defaults to 10000000</P> Tue, 26 Oct 2010 00:12:34 GMT https://community.splunk.com/t5/Splunk-Search/Are-lookup-tables-indexed/m-p/77098#M19504 carmackd 2010-10-26T00:12:34Z https://community.splunk.com/t5/Splunk-Search/Are-lookup-tables-indexed/m-p/77099#M19505 <P>Once the csv file reaches 10 MB (by default; can be changed under <CODE>max_memtable_bytes</CODE> in <CODE>limits.conf</CODE>), then it is indexed to disk. You will see the index created in your apps lookup directory alongside the CSV.</P> Tue, 26 Oct 2010 00:39:41 GMT https://community.splunk.com/t5/Splunk-Search/Are-lookup-tables-indexed/m-p/77099#M19505 araitz 2010-10-26T00:39:41Z https://community.splunk.com/t5/Splunk-Search/Are-lookup-tables-indexed/m-p/77100#M19506 <P>So if the lookup table file size is less than this magic number, does Splunk simply look through the table at search time?</P> Tue, 26 Oct 2010 00:58:27 GMT https://community.splunk.com/t5/Splunk-Search/Are-lookup-tables-indexed/m-p/77100#M19506 carmackd 2010-10-26T00:58:27Z https://community.splunk.com/t5/Splunk-Search/Are-lookup-tables-indexed/m-p/77101#M19507 <P>We maintain an index of the lookup in memory until it reaches the 10 MB, so we are searching the index rather than scanning the table.</P> Wed, 27 Oct 2010 00:30:51 GMT https://community.splunk.com/t5/Splunk-Search/Are-lookup-tables-indexed/m-p/77101#M19507 araitz 2010-10-27T00:30:51Z