Is there any way can one increase the limit of 10MB per Lookup File in the Editor?

[uvmk61]

I have seen suggestions to increase the size in

 [lookup]
# Maximum size of static lookup file to use a in-memory index for.
max_memtable_bytes = 200000000

/splunk_home/etc/system/local/limits.conf

This has not helped me and I continue to get the message in Lookup Editor -
"The file is too big to be edited (must be less than 10 MB)"

When I go over the Readme of Lookup Editor, it is noted under Known Limitations section

"The lookup editor is limited to editing files up to 10 MB. Files larger than this cannot be edited because it consume too much memory on some browsers."

So there is no way around being able to edit a file inside lookup editor larger than 10MB?

Thanks!

[dwcooley01]

To increase the 10 MB limit, you'll need to change the MAXIMUM_EDITABLE_SIZE value in the settings.py file found in this directory: 

/opt/splunk/etc/apps/lookup_editor/bin/lookup_editor

[ldglance]

i know this is old but i figured i put this here for anyone else having issues. yes there is a way to up this 10MB limit assuming your using the lookup editor app

https://splunkbase.splunk.com/app/1724/

the limit was put in the app because of browser memory issues back in 2017.  so long as you know that and modify the app at your own risk.

change the settings.py file and make it what you want it to be.

the source code for the file is here.

https://github.com/LukeMurphey/lookup-editor/blob/master/src/bin/lookup_editor/settings.py

you will need to go into the app directory and update it.

hope this helps anyone else having this Unique issue.

though that all being said. you might look at the reasons why your CSV is getting that large and make efforts and reducing it or changing it over to another method to keeping the data in splunk.

- Joshua Millikan

[LukeMurphey]

There isn't a way to overcome the 10 MB limit, per se. However, you can make a KV store lookup to use instead of a CSV lookup since KV lookups have no such limit.