Splunk Dev

Can i use data input for a csv file which is already a lookup file?

esmonder
Path Finder

Would there be any issues in adding in a csv files as a data input(files monitoring) that is already a lookup file?
I want to do this because searching the inputlookup table is really slow, and setting up custom alerts based on the inputlookup tables doesn't seem to be yielding any alerts (see: [https]://answers.splunk.com/answers/656957/custom-alert-based-on-inputlookup-table-not-sendin.html)

So just wondering if there is any value in the above proposed move and if there would any potential repercussions if i want to remove the index afterwards?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

IMO, searching on lookup table should be faster then that of indexed data, as it's a static data available locally on the search head. Are you running the query that you're in the post you shared? How many rows are there in the lookup table?

0 Karma

esmonder
Path Finder

Yes i am running the query in the post i shared. I figured that the eval time field is being run at eval time, that is why it is not sending alerts.

i have 3 input tables, and they all seem to take a while.
The biggest one has about 5 million rows

0 Karma

p_gurav
Champion

yes you can do that. But can you also share sample data and search you are trying to build?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...