topic Deployment Server Does Not Replace Existing Lookup CSV Files in Splunk Search

Deployment Server Does Not Replace Existing Lookup CSV Files

JanYang — Thu, 23 Oct 2025 10:24:27 GMT

I am using the deployment server to push configurations to the search heads. All the .conf files are successfully deployed. However, the CSV files under the lookups folder are not being replaced.

If I add a new CSV file, it can be successfully pushed.

But if I try to modify an existing CSV file, the deployment does not update it on the search heads.

Could you please advise why the existing CSV files are not being replaced during deployment?

Re: Deployment Server Does Not Replace Existing Lookup CSV Files

akkoem — Thu, 23 Oct 2025 10:40:48 GMT

is this a search head cluster or single search heads ?

Re: Deployment Server Does Not Replace Existing Lookup CSV Files

JanYang — Thu, 23 Oct 2025 10:42:01 GMT

search head cluster ,

Re: Deployment Server Does Not Replace Existing Lookup CSV Files

akkoem — Thu, 23 Oct 2025 10:57:13 GMT

Splunk's Best practice advises using Search Head Deployer to push applications to Search Head Cluster, However, you can still use deployment server to push your new app to Search Head Deployer , then to be pushed to SHC.

This is important in your case, since SHD has a flag in its CLI command to preserve lookups when pushing new configuration to Search Head Cluster Members.

If you must use your Deployment server, I can advise on configuration on the DS to push your new app /shcluster-apps in the Search Head Deployer. However, starting from SHD: you would need below command to override CSVs in the Search Head:

splunk apply shcluster-bundle --target <SHC_member_URI> --preserve-lookups false

Re: Deployment Server Does Not Replace Existing Lookup CSV Files

JanYang — Thu, 23 Oct 2025 11:10:28 GMT

The following error message appeared,

DS-01-24Next> splunk apply shcluster-bundle --target https://172.26.35.95:8089 --preserve-lookups false
Warning: Depending on the configuration changes being pushed, this command might initiate a rolling restart of the cluster members. Please refer to the documentation for the details. Do you wish to continue? [y/n]: y
WARNING: Server Certificate Hostname Validation is disabled. Please see server.conf/[sslConfig]/cliVerifyServerName for details.
Unknown parameter : -target

but I had never encountered a similar problem when I used 8.4.2 before.

Previously, I used the following commands:

splunk apply shcluster-bundle -action stage --answer-yes -auth admin:'password'
splunk apply shcluster-bundle -action send -target https://172.26.35.95:8089 --answer-yes -auth admin:'password'

Re: Deployment Server Does Not Replace Existing Lookup CSV Files

JanYang — Thu, 23 Oct 2025 11:13:07 GMT

I am using Deployer, maybe because my English is not good.

Re: Deployment Server Does Not Replace Existing Lookup CSV Files

JanYang — Thu, 23 Oct 2025 11:16:59 GMT

When I added
[sslConfig]
cliVerifyServerName = true,
An error will appear:
ERROR: certificate validation: self signed certificate in certificate chain

Encountered some errors while trying to obtain kvstore status.
Couldn't complete HTTP request: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed

Re: Deployment Server Does Not Replace Existing Lookup CSV Files

akkoem — Thu, 23 Oct 2025 11:28:44 GMT

sorry for the double dashes, it should be single dash as your previously successful apply command:

splunk apply shcluster-bundle -action stage --answer-yes -auth admin:'password' -preserve-lookups false splunk apply shcluster-bundle -action send -target https://172.26.35.95:8089 --answer-yes -auth admin:'password' -preserve-lookups false

Please note that this is going to override all lookups, if you have some lookup that you want to retain, move it out of the shcluster-apps directory.

Please note that I don't use -action in my bundle push. but this should still work

Re: Deployment Server Does Not Replace Existing Lookup CSV Files

PickleRick — Thu, 23 Oct 2025 11:33:24 GMT

See

https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/9.4/update-search-head-cluster-members/use-the-deployer-to-distribute-apps-and-configuration-updates

Re: Deployment Server Does Not Replace Existing Lookup CSV Files

JanYang — Thu, 23 Oct 2025 11:36:33 GMT

This still didn't work 😭

Re: Deployment Server Does Not Replace Existing Lookup CSV Files

JanYang — Thu, 23 Oct 2025 11:54:57 GMT

I have found the cause and successfully solved the problem. Thank you very much

Re: Deployment Server Does Not Replace Existing Lookup CSV Files

akkoem — Thu, 23 Oct 2025 12:58:50 GMT

is it possible that these lookups saved in private? meaning not shared globally or with app level

Settings > Lookups > Lookup table files

Then find your lookup file , check under Sharing column

Re: Deployment Server Does Not Replace Existing Lookup CSV Files

JanYang — Fri, 24 Oct 2025 01:42:01 GMT

I solved this problem by modifying the following conf file: deployer_lookups_push_mode = preserve_lookups

thanks