Hi There,
Could anyone help me understand at which Splunk layer lookup works, I mean at input layer, indexer layer or search layer.
Thanks
Rajeev
Lookups are created at search layer
https://docs.splunk.com/Documentation/Splunk/7.3.1/Knowledge/Aboutlookupsandfieldactions
Note - Maintain and Housekeep lookups on a regular basis. It creates bundles on INDEXER servers with huge amount of space.
Keep an eye on %SPLUNK_HOME%\var\run\searchpeers (on your INDEXER servers) which is a reflection of your lookup volumes (created on SEARCH servers)
Lookups work in the indexer and/or the search layer depending on how your search is written and on what you are looking up from the lookup
Example:
you have a "hostcategory" lookup that has host, category
if you search: index=your_index | lookup hostcategory host OUTPOUT category | stats count by category
this will use the lookup in the indexer.
on the other hand if you search: index=your_index | stats count by host | lookup hostcategory host OUTPOUT category
this will use the lookup in the search head since its being used after and aggregation function.
More information from docs:
https://docs.splunk.com/Documentation/Splunk/7.3.1/Knowledge/Aboutlookupsandfieldactions