topic Re: Will CSV files produced by the outputcsv command be replicated by the search head cluster? in Deployment Architecture

Will CSV files produced by the outputcsv command be replicated by the search head cluster?

606866581 — Wed, 15 Jun 2016 09:17:10 GMT

Hi all,

I currently have 1 search head running all my scheduled searches. Some of these searches use the outputcsv command to export Splunk results for use in other systems. Will these CSV files be replicated by the search head cluster? I won't be able to control which search head produces the CSV, so I need to know if Splunk deals with this or not.

I've searched through the documentation, but haven't found anything explicit. Any help would be greatly appreciated!

Thanks

Re: Will CSV files produced by the outputcsv command be replicated by the search head cluster?

606866581 — Wed, 15 Jun 2016 11:55:55 GMT

http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Outputcsv

Updates to $SPLUNK_HOME/var/run/*.csv using the outputcsv command are not replicated across the cluster.

This answered my question

Re: Will CSV files produced by the outputcsv command be replicated by the search head cluster?

woodcock — Wed, 15 Jun 2016 12:37:43 GMT

You can switch from outputcsv to outputlookup and use a KV Store instead and that should replicate everywhere.

Re: Will CSV files produced by the outputcsv command be replicated by the search head cluster?

606866581 — Wed, 15 Jun 2016 12:41:30 GMT

Thanks Gregg, this is probably the best workaround we were able to come up with

Re: Will CSV files produced by the outputcsv command be replicated by the search head cluster?

koshyk — Thu, 24 Aug 2017 21:13:28 GMT

outputlookup is better because
- As woodcock said, it is replicated to all SH members in a SHC
- You can control where the csv resides. Example if your app has a saved-search, it will ensure that the csv will reside within the app and NOT in $SPLUNK_HOME/var/run/ , thus providing more acl to the lookup