What is the difference between action.lookup and action.populate_lookup?

[ruman_splunk]

https://docs.splunk.com/Documentation/Splunk/latest/admin/savedsearchesconf mentions two lookup-generating actions: action.lookup and action.populate_lookup.

Some of the differences are clear, though not explicitly listed, in the docs. What's the complete set of differences? When should I use one or the other and when do I have to use outputlookup?

action.lookup = <boolean>
* Specifies whether the lookup action is enabled for this search.
* Default: false

action.lookup.filename = <lookup filename>
action.lookup.append = <boolean>

and

action.populate_lookup = <boolean>
* Specifies whether the lookup population action is enabled for this search.
* Default: false

action.populate_lookup.dest = <string>
run_on_startup = <boolean>
run_n_times = <unsigned integer> 

[ruman_splunk · Accepted solution]

• appending
  • action.lookup allows for appending.
  • action.populate_lookup does not.
• specifying a target lookup
  • action.lookup requires a filename (relative to the current app).
  • action.populate_lookup allows you to specify a transforms stanza or path for the lookup, and allows you to update a lookup in some other app or in etc/system/lookups.
• limits
  • action.lookup has a 50K row limit.
  • action.populate_lookup does not have a limit.
• scheduling
  • action.populate_lookup has additional scheduling options run_on_startup and run_n_times.

See also: https://community.splunk.com/t5/Splunk-Search/quot-outputlookup-quot-vs-quot-action-populate-lookup-...

So, you can't use savedsearches.conf to configure a lookup action if you need to append more than 50K results - must use outputlookup in this case.