https://community.splunk.com/t5/Splunk-Search/How-to-write-lookup-app-file-to-update-to-correct-location-with/m-p/182758#M52624 <P>I've written a lookup app called TA-browscap_lookup_express. It needs to write data out to a CSV to be re-used on future searches. When I had everything on a single machine, it worked fine, but now that I've gone to a distributed setup, I've noticed that the app runs on the indexer, not the search head, and that it runs in $SPLUNK_HOME/var/run/searchpeers/mypeer-somecode/apps\TA-browscap_express/bin. "somecode" gets regenerated, so basically the whole point of speeding up browscap lookups with a cache is lost because the cache is written to a different location on every run. I'm obviously doing something wrong, so my question is: what's the right way to write this file so that it is updated and persists between searches?</P> <P>Thanks,<BR /> Rob</P> Mon, 28 Sep 2020 17:20:37 GMT robertlabrie 2020-09-28T17:20:37Z https://community.splunk.com/t5/Splunk-Search/How-to-write-lookup-app-file-to-update-to-correct-location-with/m-p/182758#M52624 <P>I've written a lookup app called TA-browscap_lookup_express. It needs to write data out to a CSV to be re-used on future searches. When I had everything on a single machine, it worked fine, but now that I've gone to a distributed setup, I've noticed that the app runs on the indexer, not the search head, and that it runs in $SPLUNK_HOME/var/run/searchpeers/mypeer-somecode/apps\TA-browscap_express/bin. "somecode" gets regenerated, so basically the whole point of speeding up browscap lookups with a cache is lost because the cache is written to a different location on every run. I'm obviously doing something wrong, so my question is: what's the right way to write this file so that it is updated and persists between searches?</P> <P>Thanks,<BR /> Rob</P> Mon, 28 Sep 2020 17:20:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-lookup-app-file-to-update-to-correct-location-with/m-p/182758#M52624 robertlabrie 2020-09-28T17:20:37Z https://community.splunk.com/t5/Splunk-Search/How-to-write-lookup-app-file-to-update-to-correct-location-with/m-p/182759#M52625 <P>A generic idea would be to create a directory such as <CODE>/tmp/splunk/TA-browscap_express</CODE> and use that.</P> Thu, 14 Aug 2014 21:08:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-lookup-app-file-to-update-to-correct-location-with/m-p/182759#M52625 martin_mueller 2014-08-14T21:08:33Z https://community.splunk.com/t5/Splunk-Search/How-to-write-lookup-app-file-to-update-to-correct-location-with/m-p/182760#M52626 <P>Hi Martin, thanks for your reply. I thought about this, either extracting the TEMP env var or making it configurable pointing to some CIFS/NFS share, which is still on the table. I'm hoping there is a splunk-centric way of doing this (like maybe I can use the API and store the matches in an index). Worst case I'll drop an ini file in the app and for distributed setups let people use a share.</P> Fri, 15 Aug 2014 01:14:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-lookup-app-file-to-update-to-correct-location-with/m-p/182760#M52626 robertlabrie 2014-08-15T01:14:59Z https://community.splunk.com/t5/Splunk-Search/How-to-write-lookup-app-file-to-update-to-correct-location-with/m-p/182761#M52627 <P>In the end I decided to make the file location configurable, and configured it to be a CIFS share. This solved the problem with the least amount of work. Writing data back to splunk through the API would have been cooler, but much more work.</P> Thu, 21 Aug 2014 13:45:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-lookup-app-file-to-update-to-correct-location-with/m-p/182761#M52627 robertlabrie 2014-08-21T13:45:30Z