Yes. The limiting factor would most likely be the subsearch, not the lookup. After the subsearch executes, Splunk translates the outer search to:
| inputlookup url_lookup where NOT (url=foo OR url=bar OR url=baz OR url=qux OR ...)
up to the number or live URLs. Internal Splunk limits apply, but the search string itself can be quite long. I don't think the limit is documented, but it's probably related to the maximum request size accepted by splunkweb for manually typed searches and splunkd for derived searches.
... View more