topic Re: Does the lookup command have a limit in Splunk Search

Does the lookup command have a limit

klim — Mon, 18 Oct 2021 18:03:35 GMT

I am currently using a lookup to find matching IDs in my data. The lookup table is like 400k rows and if I use inputlookup with a join or append there is a limit to the amount of rows that is searched for from the lookup table.

I am now using just the command "lookup" to find the matching data and it works without any truncating warnings but I'm wondering if there is a limit for this command similar to subsearches. I can't seem to find anything in the lookup documentation.

sample search index=some_index | lookup users_list.csv ID OUTPUTNEW username

I output a new variable so that I can do " search username=*" since username is a new field and that will give me only matching IDs in my lookup table.

Re: Does the lookup command have a limit

richgalloway — Mon, 18 Oct 2021 18:46:49 GMT

The lookup command does not have a (practical) limit.

Re: Does the lookup command have a limit

klim — Mon, 18 Oct 2021 19:03:31 GMT

What do you mean by (pratical)?

Re: Does the lookup command have a limit

richgalloway — Mon, 18 Oct 2021 19:21:51 GMT

One that you are likely to run into. There's bound to be some sort of limit in the code, but nothing that an ordinary lookup file is going to hit.