Working with lookup tables larger than 10500.

[mike-48735]

I have many lookup tables that I am working with and I am using the REST API to dynamically populate the lookup tables on a dashboard drop down.  The issue I am running into is that I am trying to verify if data already exists in one of the lookup tables.  I can use the inputlookup to search the lookup files but this is restricted to the subsearch limit of 10500, many of the tables are much larger than this.  So I have two questions...

1 - How can I specify a string and use the lookup search?  I have tried variations of, which hasn't worked.

| eval search_term = item1
| lookup table1.csv item1 as column1
| search decription

2 - How can I use the following search to dynamically search all lookup tables and not use inputlookup to avoid the subsearch limit?

| REST /services/data/lookup-table-files splunk_server=*
| table title
| search title=*
| map search="|inputlookup $title$"
| search Column1=$search_item$
| table Column1, Column2, Column3

[richgalloway]

1 - Please describe how the first search failed.  What were the expected results and what were the actual results?  Does table1.csv have a column named "description"?  Have you tried specifying a RHS in the search command?

| eval search_term = item1
| lookup table1.csv item1 as column1 OUTPUT description
| search decription=*

2 - This appears to be a different requirement from the first search.  Here we're searching all lookup files rather than just one.  Have you tried using a where clause to reduce the number of records read?

| REST /services/data/lookup-table-files splunk_server=*
| fields title
| search title=*
| map search="|inputlookup $title$ where Column1=$search_item$"
| table Column1, Column2, Column3

BTW, the fields command (table in the OP) discards all but the title field so there is no search_item available to the map command.

[mike-48735]

The search doesn't fail when using this method.  

| map search="|inputlookup $title$ where Column1=$search_item$"

 Its just that the results aren't correct because some of the lookup tables are larger than the subsearch limit.  The $search_item$ is a field from the dashboard text input.

Yes all the lookup tables have a description column.  All other lookup commands work fine.

The two searches are different because search 1 is an example of what I would like to work, but example 2 is the search that works but the results are incomplete.

In reference to search 1 how can I use a lookup where I provide the value/string and it is not matched from a search?

How could I implement this as a where clause?  I am not tied to the map command it was just the method I got working but the results are not complete.