Monitoring Splunk

Lookup Table vs Summary Index

Sriram
Communicator

I want to create a summary index using a scheduled daily saved search and use in the dashboard view.I can accomplish this using a scheduled daily saved search and create a lookup table as well.In terms of performance, which one is preferable.

For eg.
I have a scheduled search which either build a summary index daily or build a lookup table daily.
Prior to that, I want to wreck and rebuild the summary index and lookup table daily as well.

Using Summary Index
index=cc_user_summary source=list_users | fields costCenter, displayName, userUid

Using Lookup table
| inputlookup userlist.csv | fields costCenter, displayName, userUid

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Use the lookup table.

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...