Does the performance of the kvstore lookup definition improve when it filters the original collection?

[landen99]

When a kvstore lookup definition filters a kvstore of 1 million events down to 300k, does performance improve vs using the original kvstore collection unfiltered?

[landen99 · Accepted solution]

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf?splunkbot

filter = <string>
* Filter results from the lookup table before returning data. Create this filter like you would a typical search query using Boolean expressions and/or comparison operators.
* For KV Store lookups, filtering is done when data is initially retrieved to improve performance.
* For CSV lookups, filtering is done in memory.

It looks like performance is improved after the filter is applied on reading the kvstore.