Building for the Splunk Platform

Can i use data input for a csv file which is already a lookup file?

esmonder
Path Finder

Would there be any issues in adding in a csv files as a data input(files monitoring) that is already a lookup file?
I want to do this because searching the inputlookup table is really slow, and setting up custom alerts based on the inputlookup tables doesn't seem to be yielding any alerts (see: [https]://answers.splunk.com/answers/656957/custom-alert-based-on-inputlookup-table-not-sendin.html)

So just wondering if there is any value in the above proposed move and if there would any potential repercussions if i want to remove the index afterwards?

0 Karma

somesoni2
Revered Legend

IMO, searching on lookup table should be faster then that of indexed data, as it's a static data available locally on the search head. Are you running the query that you're in the post you shared? How many rows are there in the lookup table?

0 Karma

esmonder
Path Finder

Yes i am running the query in the post i shared. I figured that the eval time field is being run at eval time, that is why it is not sending alerts.

i have 3 input tables, and they all seem to take a while.
The biggest one has about 5 million rows

0 Karma

p_gurav
Champion

yes you can do that. But can you also share sample data and search you are trying to build?

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...