We are using add-on version 3.7.0 on Splunk 7.3.3. Our lookup has 19,000+ entries similar to this: | inputlookup oracle_ora_codes.csv | head 5 ACTION CAUSE DESCRIPTION ORACODE None Normal exit. normal, successful completion ORA-00000 Either remove the unique restriction or do not insert the key. An UPDATE or INSERT statement attempted to insert a duplicate key. For Trusted Oracle configured in DBMS MAC mode, you may see this message if a duplicate entry exists at a different level. unique constraint (string.string) violated ORA-00001 Either remove the unique restriction or do not insert the key. An UPDATE or INSERT statement attempted to insert a duplicate key. For Trusted Oracle configured in DBMS MAC mode, you may see this message if a duplicate entry exists at a different level. unique constraint (string.string) violated ORA-1 This is used internally; no action is required. The current session was requested to set a trace event by another session. session requested to set trace event ORA-00017 This is used internally; no action is required. The current session was requested to set a trace event by another session. session requested to set trace event ORA-17     ... View more