topic What is the fastest way to use a lookup (or match records against a secondary source)? in Splunk Search

What is the fastest way to use a lookup (or match records against a secondary source)?

loganramirez — Mon, 22 May 2023 17:47:53 GMT

I have index with json data that represents call data (phone calls), but there is nothing native in the index that represents lists.

Assume, for example, I have a list called "Splunk Legends" and it represents 10 numbers.

Currently if I want to 'count all calls last 30d from Splunk Legends, then I do

index=mydata | stats value(*) by guid -- because I'm joining some other interesting information in this index | lookup mylookup.csv number OUTPUT list | search list="Splunk Legends"

What I dislike about this, of course, is I have to search the entire index.

Thoughts on a better way to match value against an external data source?

Thank you!

Re: What is the fastest way to use a lookup (or match records against a secondary source)?

richgalloway — Mon, 22 May 2023 18:58:19 GMT

Try incorporating the lookup into the base search.

index=mydata [ | inputlookup mylookup.csv where list="Splunk Legends" | fields number | format ] | stats value(*) by guid -- because I'm joining some other interesting information in this index ...

Re: What is the fastest way to use a lookup (or match records against a secondary source)?

loganramirez — Mon, 22 May 2023 19:50:04 GMT

Legend. Thank you!

Re: What is the fastest way to use a lookup (or match records against a secondary source)?

loganramirez — Mon, 22 May 2023 20:24:51 GMT

thoughts on the 10k limit using sub searches like this? just ran into that.