Does the lookup command have a limit

[klim]

I am currently using a lookup to find matching IDs in my data. The lookup table is like 400k rows and if I use inputlookup with a join or append there is a limit to the amount of rows that is searched for from the lookup table.

I am now using just the command "lookup" to find the matching data and it works without any truncating warnings but I'm wondering if there is a limit for this command similar to subsearches. I can't seem to find anything in the lookup documentation.

sample search index=some_index | lookup users_list.csv ID OUTPUTNEW username

I output a new variable so that I can do " search username=*" since username is a new field and that will give me only matching IDs in my lookup table.

[richgalloway · Accepted solution]

The lookup command does not have a (practical) limit.

[klim]

What do you mean by (pratical)?

[richgalloway]

One that you are likely to run into.  There's bound to be some sort of limit in the code, but nothing that an ordinary lookup file is going to hit.