|
If I have a bunch of events in a tabular format that I wish to search for various charts on a dashboard, is it faster to input the events with inputlookup or is it better to save them in a summary index and search the index? Thx. Craig |
|
Depends on the size of the lookup table. If it's less than 10MB, it's almost certainly faster to use inputlookup because it'll be sitting in memory already. http://answers.splunk.com/questions/8326/are-lookup-tables-indexed However bear in mind that you get all sorts of extra flexibility when you have summary indexing going. It's not uncommon for a lookup solution to get replaced down the road by a summary index solution when you need that flexibility. Like when the values start changing over time and you need to report on the changes. |
