Lookup File Editor: Is there any workaround other than reducing the lookup file size?

[AHA-0114]

I try to edit lookup file through the lookup file editor, but below message is shown.
The file is too big to be edited (must be less than 10 MB)
Is there any workaround other than reducing the lookup file size?

[gcusello · Accepted solution]

Hi @AHA-0114,

there are two solutions:

• modify "ingest_max_memtable_bytes parameter in limits.conf (default 10 M) (for more infos see at https://docs.splunk.com/Documentation/Splunk/8.2.5/Admin/Limitsconf),
• divide your lookups.

If possible the second is better so you don't modify standard configurations, otherwise, you can use the first.

Ciao.

Giuseppe