What is the maximum recommended size for asset/identity lookups?
I've had issues with Splunk handling large numbers of assets and/or identities. I increased the maximum bundle size to 4GB, but still had to distribute the entire huge bundle every time an identity changed.
Is there an option to use a KV store for assets & identities? Or a way to update them with a diff, rather than pushing the entire lookup?
Is there a memory requirement for a certain number of assets & identities? Or any related performance impact for having a large number of assets & identities?
Thanks for the help.
With large A&I lookups, does Splunk provide memory recommendation for acceptable performance?
For example, if my asset list only contains ip, dns, priority, bunit, andcategory, how many Class A networks can I put in the lookup if the networks are 50% allocated?