See title, I'm using a scheduled query to prune a set of results from a lookup table, this lookup table has over 2m results, but after the prune, it's truncated down to 50,000. This exclusively happens when I schedule the lookup table with the "replace" option. Append works perfectly. Pruning script:
| inputlookup my_lookup.csv
| where _time > relative_time(now(),"-6m")
Pruning schedule options:
I've tried setting the output location to both my_lookup.csv and to other lookups. In both cases, 50,000 results seems to be the limit for the replaced lookup table. Append schedule options:
Any help is appreciated.
... View more