The end results are "the same" (in the stats table, for example)
But when you go to Activity->Jobs, you'll notice the size of the results might be 268MB for the first form, and only 140MB in the second
And that size is vital when you're dealing with disk quotas for individual users of ~1GB 🙂
June 05, 2020 at 04:03PM
via reddit https://www.reddit.com/r/Splunk/comments/gx7604/why_is_inputlookup_in_the_initial_search_line/ft0al5a?utm_source=ifttt