All Apps and Add-ons

Is there any way can one increase the limit of 10MB per Lookup File in the Editor?

uvmk61
New Member

I have seen suggestions to increase the size in

 [lookup]
# Maximum size of static lookup file to use a in-memory index for.
max_memtable_bytes = 200000000

/splunk_home/etc/system/local/limits.conf

This has not helped me and I continue to get the message in Lookup Editor -
"The file is too big to be edited (must be less than 10 MB)"

When I go over the Readme of Lookup Editor, it is noted under Known Limitations section

"The lookup editor is limited to editing files up to 10 MB. Files larger than this cannot be edited because it consume too much memory on some browsers."

So there is no way around being able to edit a file inside lookup editor larger than 10MB?

Thanks!

Tags (1)
0 Karma

ldglance
New Member

i know this is old but i figured i put this here for anyone else having issues. yes there is a way to up this 10MB limit assuming your using the lookup editor app

https://splunkbase.splunk.com/app/1724/

the limit was put in the app because of browser memory issues back in 2017.  so long as you know that and modify the app at your own risk.

change the settings.py file and make it what you want it to be.

the source code for the file is here.

https://github.com/LukeMurphey/lookup-editor/blob/master/src/bin/lookup_editor/settings.py

you will need to go into the app directory and update it.

hope this helps anyone else having this Unique issue.

though that all being said. you might look at the reasons why your CSV is getting that large and make efforts and reducing it or changing it over to another method to keeping the data in splunk.

- Joshua Millikan

0 Karma

LukeMurphey
Champion

There isn't a way to overcome the 10 MB limit, per se. However, you can make a KV store lookup to use instead of a CSV lookup since KV lookups have no such limit.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...