- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Lookup Max Match
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
For you lookup table file, create a lookup definition (from Manager -> Lookups -> Lookup Definitions). give it same sharing permissions as the lookup table file and in the "Advanced options" provide appropriate value.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
For you lookup table file, create a lookup definition (from Manager -> Lookups -> Lookup Definitions). give it same sharing permissions as the lookup table file and in the "Advanced options" provide appropriate value.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I tried with the steps u provided .But it doesn't seem to work for me.
I have a lookup value which has 668 matches in the lookup table, but only 100 results are returning.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks somesoni2. That worked!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Worth noting that in Splunk 6.5.2 there is a typo. When you edit the lookup it says: "Max Matches: Enter a number from 1-1000 to specify the maximum number of matches for each input lookup value. If time-based, default is 1; otherwise, default is 1000." This seems to be incorrect in 6.5.2. It is still defaulted to 100.
Wondering How to Build Resiliency in the Cloud?
Updated Data Management and AWS GDI Inventory in Splunk Observability
Introducing the Splunk Community Dashboard Challenge!
