topic Re: My automatic lookup not working with Searchhead cluster in Getting Data In

Why is My automatic lookup not working with Searchhead cluster?

aamer86 — Wed, 06 Apr 2022 14:58:02 GMT

I have an indexing cluster and searchhead cluster.
I want to use a csv threat feeds to add IP reputation field using automatic lookup

I tried using all the online resources but It doesnt work

anyone knows a limitation for doing the automatic lookup with SearchHead clustering
I used the web based and the config files based option but didnt work

I did the manual checks and all worked

Re: My automatic lookup not working with Searchhead cluster

VatsalJagani — Tue, 05 Apr 2022 06:19:35 GMT

Please verify:

* You need to make all these configurations from SHC UI or Deployer.

* Make sure you have automatic lookup definition in the same app as your lookup csv file.

* Your automatic lookup configuration is replicated to all the search heads correctly.

* By default all CSV lookups are replicated to indexers automatically, but if not you can set "replicate=true" parameter in transforms.conf entry with your lookup definition.

* Please make sure there is no warning/error in the search.log when you try to search that data from the Job Inspect.

Re: My automatic lookup not working with Searchhead cluster

aamer86 — Tue, 05 Apr 2022 10:31:28 GMT

I tried it and it still not working

Re: My automatic lookup not working with Searchhead cluster

aamer86 — Tue, 05 Apr 2022 12:39:29 GMT

the automatic lookup (transforms.conf) file is not replicating from the deployer to the search heads

Re: My automatic lookup not working with Searchhead cluster

VatsalJagani — Tue, 05 Apr 2022 13:08:00 GMT

Have you executed the below command after making the changes?

splunk apply shcluster-bundle -target <URI>:<management_port>

If you are not much sure of the deployer and bundle push the command, please refer - https://docs.splunk.com/Documentation/Splunk/8.2.5/DistSearch/PropagateSHCconfigurationchanges

Re: My automatic lookup not working with Searchhead cluster

aamer86 — Wed, 06 Apr 2022 08:33:49 GMT

yes I did this

Re: My automatic lookup not working with Searchhead cluster

VatsalJagani — Wed, 06 Apr 2022 11:30:12 GMT

Please make sure you have your config in the right directory in deployer. Also, make sure the file has no permission issue.
Please check Splunk's _internal log regarding this, if you see any WARN or ERROR.

Re: Why is My automatic lookup not working with Searchhead cluster?

aamer86 — Sat, 09 Apr 2022 19:40:28 GMT

thanks @Anonymous I found the problem

I had the Security essential App installed on all search heads which include a LOOKUP table named account_status_tracker which was being used as the default source for any lookup operation (could be a bug in this app for Splunk to check)
Once I removed the security essentials app, it worked (not sure why. the lookup was going to this table )