Hi all,
I've got 16k and growing values in a CSV. I'd like to search for events matching those values, like
tag::eventtype="authentication" [| inputlookup cmdb_former_employees | fields user | return 999999 user ]
But it seems that this is pretty much inefficient and results in a very slow search.
Is there a better way to find events matching a large set of values form a lookup?
Thanks,
Simon
I'd try making that an auto lookup for the relevant sourcetypes.