Splunk Enterprise

Unable to append to lookup table in scheduled report



I've got a report that generates roughly 300k entries whenever it runs and want to append the results into a lookup table.


In a different post, it looked like lookup tables could hold large amounts of rows, but I'm observing that there is a cap at 50,000 entries. Is it possible to remove this cap, and if so how?

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...