@niketn wrote: @badoomi, optimizing lookup search may not be straight-forward without knowing your SPL and Splunk Infra ( as to how many Indexers you have got). However you can refer to following Splunk Documentation for one of tip to optimize lookup By default lookup command runs with argument local=true which means it is executed on Search Peer not on Search Head. If you have multiple indexers and your SPL till the lookup command have only streaming commands then there would be an advantage of this otherwise not. In essence you would need to test out stats first then lookup vs lookup first and stats next. Do share your current SPL for community members to assist you better with your use case. I think there may have been a typo this this original answer as the lookup command has local=false set by default - source: https://docs.splunk.com/Documentation/Splunk/9.1.1/SearchReference/Lookup local Syntax: local=<bool> Description: If local=true, forces the lookup to run on the search head and not on any remote peers. Default: false
... View more
