Splunk Search
×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

Should the records in time-based lookup csv file must to be sequence (order) by time?

leo_systex
Explorer
‎04-12-2018 07:47 PM

Hi,
As title.
I have done some test using small set of data in my lab.
It looks like the time-based lookup work correct when the records in csv file is not order by time.

But I am curious that if the lookup table is large ( about 1~2 GB ) , is it still working correct ?
Anyone has the experience ?

0 Karma
Reply
Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...