That makes sense … and also makes sense as to why not only would the job complete in ~15 minutes (for the specific example I found this from), but also have only about 600MB in the returned data vs running over an hour, returning over a gig – and getting "finalized" instead of completing (when I run it against the 90d lookback period the report demands)
In the shorter lookback period (10d) I was testing with over the last few days, I went from runtimes of ~15 minutes and data returned of ~260MB to a runtime of <5 minutes, and data returned ~140MB
June 05, 2020 at 07:43PM
via reddit https://www.reddit.com/r/Splunk/comments/gx7604/why_is_inputlookup_in_the_initial_search_line/ft11z5n?utm_source=ifttt