Inputlookup vs. summary index performance

[jambajuice]

If I have a bunch of events in a tabular format that I wish to search for various charts on a dashboard, is it faster to input the events with inputlookup or is it better to save them in a summary index and search the index?

Thx.

Craig

[sideview]

Depends on the size of the lookup table. If it's less than 10MB, it's almost certainly faster to use inputlookup because it'll be sitting in memory already.

http://answers.splunk.com/questions/8326/are-lookup-tables-indexed

However bear in mind that you get all sorts of extra flexibility when you have summary indexing going. It's not uncommon for a lookup solution to get replaced down the road by a summary index solution when you need that flexibility. Like when the values start changing over time and you need to report on the changes.

[netwrkr]

I would think using a summary index would always be faster.