https://community.splunk.com/t5/Getting-Data-In/How-to-replicate-CSV-lookup-from-heavy-forwarder-to-Search-Head/m-p/519097#M87809 <P>you can index csv file. You can create a saved search to create lookup with the events indexed from the lookup from HF on search Head.</P> Fri, 11 Sep 2020 15:10:07 GMT thambisetty 2020-09-11T15:10:07Z https://community.splunk.com/t5/Getting-Data-In/How-to-replicate-CSV-lookup-from-heavy-forwarder-to-Search-Head/m-p/519054#M87801 <P><SPAN>We are using a clustered environment with indexers,&nbsp; search-heads, a deployer, and a heavy forwarder (all running on the same Splunk Enterprise version).</SPAN></P><P><SPAN>We are setting up TA on a heavy forwarder which generates a CSV file(lookup table). </SPAN></P><P><SPAN>We would like to auto copy/replicate a CSV file from heavy forwarder to search-heads/indexer. Let me know how to achieve this?</SPAN></P><P>Thanks in advance.</P> Fri, 11 Sep 2020 12:34:28 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-replicate-CSV-lookup-from-heavy-forwarder-to-Search-Head/m-p/519054#M87801 mbachhav 2020-09-11T12:34:28Z https://community.splunk.com/t5/Getting-Data-In/How-to-replicate-CSV-lookup-from-heavy-forwarder-to-Search-Head/m-p/519097#M87809 <P>you can index csv file. You can create a saved search to create lookup with the events indexed from the lookup from HF on search Head.</P> Fri, 11 Sep 2020 15:10:07 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-replicate-CSV-lookup-from-heavy-forwarder-to-Search-Head/m-p/519097#M87809 thambisetty 2020-09-11T15:10:07Z https://community.splunk.com/t5/Getting-Data-In/How-to-replicate-CSV-lookup-from-heavy-forwarder-to-Search-Head/m-p/519115#M87812 <P>One method is to use rsync (or something similar) to copy the lookup file from the HF to the SH.&nbsp; The SH will handle pushing the lookup to the indexers as needed.</P> Fri, 11 Sep 2020 15:47:04 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-replicate-CSV-lookup-from-heavy-forwarder-to-Search-Head/m-p/519115#M87812 richgalloway 2020-09-11T15:47:04Z https://community.splunk.com/t5/Getting-Data-In/How-to-replicate-CSV-lookup-from-heavy-forwarder-to-Search-Head/m-p/632893#M108364 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/69461">@mbachhav</a>&nbsp;- did you get this done ? I am running into similar challenge and thinking best way of getting this from HF to SHC/Indexer&nbsp;</P> Thu, 02 Mar 2023 01:38:28 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-replicate-CSV-lookup-from-heavy-forwarder-to-Search-Head/m-p/632893#M108364 nmohammed 2023-03-02T01:38:28Z