How to make lookups faster?

[clyde772]

I realize that Splunk creates indexes for lookup tables. Can Splunk really create indexes to maximize lookup performance? How can we for splunk to index lookup tables large as in GB. So the lookup speed gets improved.

Also when we overwrite a lookup csv file update it with a latest list in large size, can we make splunk to reforce in indexes for lookups manually?

Thanks.!

[Mathieu_Dessus]

If you lookup table are big, the first thing to try is to gzip it. It should improve performance.
However, if you really need more performance, the main option is to use an external command to do the lookup, as a python script or an indexed tables in a database (for example using mysql connector).