Why is `[|inputlookup…]` in the initial search line faster than `|search [| inputlookup…]`?
Lookup tables are fantastic
But I'm trying to figure out why doing:
<search> [| inputlookup lookupname ] Is not only faster, but returns a result set substantially smaller (on the order of 50%) than this format:
<search> | search [| inputlookup lookupname ] Submitted June 05, 2020 at 11:54AM
via reddit https://www.reddit.com/r/Splunk/comments/gx7604/why_is_inputlookup_in_the_initial_search_line/?utm_source=ifttt