So how does splunk handle static lookup tables, are they indexed?
max_memtable_bytes =
* maximum size of static lookup file to use a in-memory index for
* Defaults to 10000000
Once the csv file reaches 10 MB (by default; can be changed under max_memtable_bytes
in limits.conf
), then it is indexed to disk. You will see the index created in your apps lookup directory alongside the CSV.
Once the csv file reaches 10 MB (by default; can be changed under max_memtable_bytes
in limits.conf
), then it is indexed to disk. You will see the index created in your apps lookup directory alongside the CSV.
We maintain an index of the lookup in memory until it reaches the 10 MB, so we are searching the index rather than scanning the table.
So if the lookup table file size is less than this magic number, does Splunk simply look through the table at search time?