hi,
I have two KV_Store lookups as they are huge:
* one is more than 250k rows
* second and 65k rows.
In "250k" row lookup is only IP while in second one are IP CIDR+LIST
So, I do search like
| inputlookup list_250k
| rename ip_cidr as ip
| eval convert_ip=tostring(ip)
| lookup list_65k ip_cidr AS convert_ip OUTPUT ip_cidr, list
| where isNotNull(ip_cidr)
| rename ip_cidr as found_in
I am getting results. I am curious are there any limits?
if for example search is limited, would I see some error (as there is no progress bar that it's working something)?
AFAIK, There is no limitation. It might take some time if there are a lot of records in kvstore but no limitations.
https://docs.splunk.com/Documentation/SplunkCloud/9.0.2305/SearchReference/Lookup