Are lookup tables indexed?

[carmackd]

So how does splunk handle static lookup tables, are they indexed?

max_memtable_bytes =
* maximum size of static lookup file to use a in-memory index for
* Defaults to 10000000

[araitz · Accepted solution]

Once the csv file reaches 10 MB (by default; can be changed under max_memtable_bytes in limits.conf), then it is indexed to disk. You will see the index created in your apps lookup directory alongside the CSV.

[araitz]

We maintain an index of the lookup in memory until it reaches the 10 MB, so we are searching the index rather than scanning the table.

[carmackd]

So if the lookup table file size is less than this magic number, does Splunk simply look through the table at search time?