That makes sense – though not exactly why the ending resultset would still be so much bigger … unless Splunk's holding-onto all those unfiltered results for funzies?
June 05, 2020 at 03:12PM
via reddit https://www.reddit.com/r/Splunk/comments/gx7604/why_is_inputlookup_in_the_initial_search_line/ft045nr?utm_source=ifttt