topic Re: Why aren't lookups replicating on search head (SH) cluster? in Deployment Architecture

Why aren't lookups replicating on search head (SH) cluster?

pfabrizi — Thu, 04 Oct 2018 16:28:30 GMT

I have a 3 node SH cluster. I pushed a custom app from the deployer that had a local folder (just a transforms.conf for 2 lookup tables) and I had a folder with 2 lookup tables.

The lookup tables are being pushed to SH's via a crontab running on our Enterprise Security. Since this would get overlaid by a bundle push, I removed the lookup folder from the deployer and re-pushed the bundle.

What I noticed is the lookup tables are not being replicated when they change. I had also noticed that when I removed the folder from the deployer and pushed the bundle, it didn't remove the lookup folder from the 3 SH nodes, which I had expected. My guess is there is something stuck?

Thanks!

Re: Why aren't lookups replicating on search head (SH) cluster?

chskm — Thu, 11 Oct 2018 17:49:04 GMT

There might be too much size w.r.t. the lookup table, this might be the reason causing not being replicated.
Also, it won't simply remove from the search heads even if you remove from your lookup folder on deployer. There would be a command where it will remove these kind of things from peers, please check with the splunk doc. docs.splunk.com

Re: Why aren't lookups replicating on search head (SH) cluster?

gjanders — Thu, 11 Oct 2018 22:07:19 GMT

Are you pushing files onto the search head and then expecting the replication to just work?

If so you might want to send the lookup files through via a REST API call rather than just scp'ing files to the search head server