I have not run into any restrictions. Are you asking about lookup tables that you'll use as lookups (using the lookup
search command) or lookup tables that you'll use as search filters (using the inputlookup
search command)? The first is likely to slow things down if you are running a lot of chained lookups, and the latter is possible to grow your search results to an unmanageable size, depending on the size of the lookup file.
@logloganathan, how many lookup files are you planning to have? Rather than search limitation you should consider from Admin point of view as to how many lookup tables can you maintain for a single app.
What is the kind of data that your lookup tables can have and reason for several lookups to be used in single search? Can you index the lookup files and use index, source, sourcetype for correlation?
You should also consider creating KV Store for better maintenance of such kind of data.
I don't believe there is a limit - however, using many large lookups can impact your performance.
I have not run into any restrictions. Are you asking about lookup tables that you'll use as lookups (using the lookup
search command) or lookup tables that you'll use as search filters (using the inputlookup
search command)? The first is likely to slow things down if you are running a lot of chained lookups, and the latter is possible to grow your search results to an unmanageable size, depending on the size of the lookup file.