Splunk Search

At which layer lookup works?

rajeev_ku
Path Finder

Hi There,
Could anyone help me understand at which Splunk layer lookup works, I mean at input layer, indexer layer or search layer.

Thanks
Rajeev

Tags (1)
0 Karma

nareshinsvu
Builder

Lookups are created at search layer

https://docs.splunk.com/Documentation/Splunk/7.3.1/Knowledge/Aboutlookupsandfieldactions

Note - Maintain and Housekeep lookups on a regular basis. It creates bundles on INDEXER servers with huge amount of space.
Keep an eye on %SPLUNK_HOME%\var\run\searchpeers (on your INDEXER servers) which is a reflection of your lookup volumes (created on SEARCH servers)

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Lookups work in the indexer and/or the search layer depending on how your search is written and on what you are looking up from the lookup

Example:
you have a "hostcategory" lookup that has host, category

if you search: index=your_index | lookup hostcategory host OUTPOUT category | stats count by category
this will use the lookup in the indexer.

on the other hand if you search: index=your_index | stats count by host | lookup hostcategory host OUTPOUT category
this will use the lookup in the search head since its being used after and aggregation function.

More information from docs:
https://docs.splunk.com/Documentation/Splunk/7.3.1/Knowledge/Aboutlookupsandfieldactions

------------
Hope I was able to help you. If so, some karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 2)

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Index This | I am a number but I am countless. What am I?

January 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  Happy New Year! We’re ...

What’s New in Splunk Enterprise 9.4: Tools for Digital Resilience

PLATFORM TECH TALKS What’s New in Splunk Enterprise 9.4: Tools for Digital Resilience Thursday, February 27, ...