Monitoring Splunk

Inputlookup vs. summary index performance

jambajuice
Communicator

If I have a bunch of events in a tabular format that I wish to search for various charts on a dashboard, is it faster to input the events with inputlookup or is it better to save them in a summary index and search the index?

Thx.

Craig

Tags (1)

sideview
SplunkTrust
SplunkTrust

Depends on the size of the lookup table. If it's less than 10MB, it's almost certainly faster to use inputlookup because it'll be sitting in memory already.

http://answers.splunk.com/questions/8326/are-lookup-tables-indexed

However bear in mind that you get all sorts of extra flexibility when you have summary indexing going. It's not uncommon for a lookup solution to get replaced down the road by a summary index solution when you need that flexibility. Like when the values start changing over time and you need to report on the changes.

0 Karma

netwrkr
Communicator

I would think using a summary index would always be faster.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...