At least as of 8.x … CSV lookups work fine with 100s of 1000s of rows
KV store may be better – but the CSVs do work (depending on line length, of course)
August 13, 2020 at 11:10AM
via reddit https://www.reddit.com/r/Splunk/comments/i8xf50/current_status_from_past_changes/g1c1sl1?utm_source=ifttt