https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-replicate-bash-script-generated-lookup-across/m-p/496549#M138363 <P>Hi folks,</P> <P>I am using a bash script to download data to populate a CSV that I'd like to use as a lookup in Splunk.</P> <P>So far I have created the empty lookup on our deployer, which has successfully pushed it out to the search head cluster members.</P> <P>I have a script running on the cluster-master that populates the empty lookup, the changes, however, are not replicating across the cluster, I expected this to work as the lookup location is whitelisted for replication in server.conf.</P> <P>The changes to the CSV are failing to replicate across the cluster, do the changes to a lookup need to happen within Splunk for lookup replication to work?</P> <P>An alternative solution would be to generate the script on the deployer and script a bundle push every 12 hours. I'm reluctant to have automated bundle pushes occurring outwith office hours due to issues we've experienced previously.</P> <P>Has anyone ever attempted to do something similar, and is able to offer any guidance?</P> <P>Many thanks,</P> <P>Miles</P> Tue, 01 Oct 2019 14:00:45 GMT milesmedboe 2019-10-01T14:00:45Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-replicate-bash-script-generated-lookup-across/m-p/496549#M138363 <P>Hi folks,</P> <P>I am using a bash script to download data to populate a CSV that I'd like to use as a lookup in Splunk.</P> <P>So far I have created the empty lookup on our deployer, which has successfully pushed it out to the search head cluster members.</P> <P>I have a script running on the cluster-master that populates the empty lookup, the changes, however, are not replicating across the cluster, I expected this to work as the lookup location is whitelisted for replication in server.conf.</P> <P>The changes to the CSV are failing to replicate across the cluster, do the changes to a lookup need to happen within Splunk for lookup replication to work?</P> <P>An alternative solution would be to generate the script on the deployer and script a bundle push every 12 hours. I'm reluctant to have automated bundle pushes occurring outwith office hours due to issues we've experienced previously.</P> <P>Has anyone ever attempted to do something similar, and is able to offer any guidance?</P> <P>Many thanks,</P> <P>Miles</P> Tue, 01 Oct 2019 14:00:45 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-replicate-bash-script-generated-lookup-across/m-p/496549#M138363 milesmedboe 2019-10-01T14:00:45Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-replicate-bash-script-generated-lookup-across/m-p/496550#M138364 <P>Found a workaround here, implemented it and it is doing exactly what I wanted to do - <A href="https://medium.com/@clong/splunk-building-dynamic-lookup-tables-a593261569">https://medium.com/@clong/splunk-building-dynamic-lookup-tables-a593261569</A></P> <P>Would be nice to see Splunk handling stuff like this better in future releases </P> Tue, 01 Oct 2019 15:09:54 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-replicate-bash-script-generated-lookup-across/m-p/496550#M138364 milesmedboe 2019-10-01T15:09:54Z