Why is the first search doing all of this extra work? We are about to roll out access to Splunk to about 150 employees. I want to make sure I understand the proper way to recommend people to run searches against this index that is linked to the lookup table.
Thanks in advance,
The second search is going directly for the index to look for your guid. The first one needs to match (don't know how many fields are you matching against the lookup) every event to the lookup before filtering, and that's where this questions come into place
Is that lookup CSV or KVStore based?
If it is KVStore, maybe you'd prefer it to be replicated to the Indexer layer for performance increase?
How frequently is that lookup updated?
It depends on how many definitions exist to create the field
guid and what types they are. This is a VERY deep topic. Start here and pay special attention to the parts regarding
Also check out this:
If the field
guid is an indexed field, then you can use this: