There's a section in the docs about performance. http://docs.splunk.com/Documentation/DBX/1.0.8/DeployDBX/Otherdeploymentconsiderations#Performance_considerations Because Splunk DB Connect queries your database, there is a possiblity that your queries may impact that database's performance. In particular, if the initial run of your query to the database retrieves a lot of data, this may affect the performance of your database. Subsequent runs of the query should generally be less impactful, as they are only retrieving data that is new since the previous run of the query. To mitigate this, you can set the tail.follow.only directive, which is only exposed in inputs.conf. Lookups generate multiple selects that should be within the expected workload for a database and should not affect performance. Splunk DB Connect will execute a separate SELECT statement for each unique combination of input fields. This may happen more than once per search, because the search preview function in Splunk may invoke the lookup multiple times during execution of a search for parts of the results. Splunk will not cache the results between invocations of the lookup. ... View more