topic Re: Is there a way to make automatic lookups only use the local lookup table that exists on my search head? in Splunk Search https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-make-automatic-lookups-only-use-the-local/m-p/744178#M241232 <P>I know this is old, but it's the first Google result.</P><P>A workaround is Calculated fields can use |eval lookup(). The lookup must be a .csv file on the search head(s).</P><P>&nbsp;</P><P><A href="https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/definecalcfields" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/definecalcfields</A></P><P><A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ConditionalFunctions" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ConditionalFunctions</A></P> Tue, 15 Apr 2025 14:27:53 GMT elewis1 2025-04-15T14:27:53Z Is there a way to make automatic lookups only use the local lookup table that exists on my search head? https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-make-automatic-lookups-only-use-the-local/m-p/36416#M8101 <P>From my search flashtimeline I can tell my search head in a distributed environment to only use the local lookup file by adding local=true to my lookup statement. Is there a way to make automatic lookups only use the local lookup table that exists on my Search Head?</P> Tue, 13 Dec 2022 15:08:56 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-make-automatic-lookups-only-use-the-local/m-p/36416#M8101 Flynt 2022-12-13T15:08:56Z Re: Using Local=true in Automatic Lookups https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-make-automatic-lookups-only-use-the-local/m-p/36417#M8102 <P>Looking at <A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/propsconf">props.conf.spec</A> and <A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/transformsconf">transforms.conf.spec</A>, there doesn't seem to be a way to configure an automatic lookup to occur only locally on the search-head.</P> <P>Time to file an enhancement request!</P> Thu, 14 Nov 2013 19:47:07 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-make-automatic-lookups-only-use-the-local/m-p/36417#M8102 hexx 2013-11-14T19:47:07Z Re: Using Local=true in Automatic Lookups https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-make-automatic-lookups-only-use-the-local/m-p/509488#M142385 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/681">@hexx</a>&nbsp;Is there a way <SPAN>to configure an automatic lookup to occur only locally on the search-head now?</SPAN></P> Thu, 16 Jul 2020 09:53:00 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-make-automatic-lookups-only-use-the-local/m-p/509488#M142385 potnuru 2020-07-16T09:53:00Z Re: Using Local=true in Automatic Lookups https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-make-automatic-lookups-only-use-the-local/m-p/624127#M216979 <P>To&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/34483">@potnuru</a>&nbsp; and others that might fall here .. there is a setting on transforms.conf called <STRONG>replicate&nbsp;</STRONG>to:&nbsp;</P><PRE>Indicates whether to replicate CSV lookups to indexers</PRE><P>&nbsp;</P> Tue, 13 Dec 2022 12:22:38 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-make-automatic-lookups-only-use-the-local/m-p/624127#M216979 nunoaragao 2022-12-13T12:22:38Z Re: Using Local=true in Automatic Lookups https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-make-automatic-lookups-only-use-the-local/m-p/624173#M217000 <P>This is the solution I was looking for. The lookup definition UI does&nbsp;<EM>not</EM> have the option to keep it local like the SPL does. This is effectively making the lookup local wherever/whenever called.</P><P>Thanks for insight... better late than never <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 13 Dec 2022 21:41:27 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-make-automatic-lookups-only-use-the-local/m-p/624173#M217000 rquish 2022-12-13T21:41:27Z Re: Is there a way to make automatic lookups only use the local lookup table that exists on my search head? https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-make-automatic-lookups-only-use-the-local/m-p/744178#M241232 <P>I know this is old, but it's the first Google result.</P><P>A workaround is Calculated fields can use |eval lookup(). The lookup must be a .csv file on the search head(s).</P><P>&nbsp;</P><P><A href="https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/definecalcfields" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/definecalcfields</A></P><P><A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ConditionalFunctions" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ConditionalFunctions</A></P> Tue, 15 Apr 2025 14:27:53 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-make-automatic-lookups-only-use-the-local/m-p/744178#M241232 elewis1 2025-04-15T14:27:53Z