Splunk Search

Lookup limits

keerthana_k
Communicator

We have a CSV table from where we perform lookups. The CSV file has nearly 50000 rows. When I run the lookup query, results are not returned for some of the rows. I picked one value for which lookup was not happening, made its entry the first row (earlier it was the 5286th row) in the CSV and reduced the number of rows in the CSV to 3. The lookup was then successful.

Is there any limit to the number of rows that will be looked up when we run lookup command?

I checked the max_memtable_bytes value in my limits.conf and the CSV table size is way below the limit. We use Splunk version 5.0.4

Thanks,

Keerthana

Tags (1)
1 Solution

strive
Influencer

Check for unmatched/Orphan double quotes in your CSV files. That will cause problem and lookups wont be complete.

View solution in original post

strive
Influencer

Check for unmatched/Orphan double quotes in your CSV files. That will cause problem and lookups wont be complete.

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...