topic Re: How to distribute lookup tables in an indexer clustering environment? in Splunk Search

How to distribute lookup tables in an indexer clustering environment?

horsefez — Tue, 19 Jan 2016 11:24:18 GMT

Hi,

I have an environment consisting of two Indexers (clustered), one search head and one master node. I already read about distributing changes in the environment over the cluster-bundle function.
Now I want to add lookup tables.

Do I need to configure and upload the files on the master node?
Can I distribute the lookup files/definitions via cluster-bundle?

Thanks in advance!

Kind regards,
pyro_wood

Re: How to distribute lookup tables in an indexer clustering environment?

gyslainlatsa — Tue, 19 Jan 2016 12:56:38 GMT

hi pyro_wood,

Search head pooling makes all files in $SPLUNK_HOME/etc/{apps,users} available for sharing. This includes *.conf files, *.meta files, view files, search scripts, lookup tables, etc

for more informations, follow this link:
http://docs.splunk.com/Documentation/Splunk/6.3.2/DistSearch/Configuresearchheadpooling

Re: How to distribute lookup tables in an indexer clustering environment?

fdi01 — Tue, 19 Jan 2016 13:49:48 GMT

as you don not have a DS(deployment server).
you Can use cluster-bundle to distribute the lookup-files/definitions.

Re: How to distribute lookup tables in an indexer clustering environment?

horsefez — Tue, 19 Jan 2016 13:54:13 GMT

So, I do need to add lookup-files on the master-node first right?

I heard about the option to import lookup-tables onto a search head and then distribute. Is this a valid option, too?

Re: How to distribute lookup tables in an indexer clustering environment?

alemarzu — Tue, 19 Jan 2016 17:12:10 GMT

Cluster-bundle will deploy those configurations to your Peers, not to your Search Head. To do that, use Deployment Server.

Edit: May I ask why do you want to deploy lookups to your Peers ? Search time configurations, including lookup tables go on the search head and the search head only.

Re: How to distribute lookup tables in an indexer clustering environment?

horsefez — Wed, 20 Jan 2016 10:50:09 GMT

I thought lookuptables need to be stored on the same peers as the data resides.

So I thought i need to upload and configure lookuptables on the master-node to then distribute them to the indexers.

Re: How to distribute lookup tables in an indexer clustering environment?

alemarzu — Wed, 20 Jan 2016 13:14:19 GMT

You wont need to, just drop them in your search head.

Re: How to distribute lookup tables in an indexer clustering environment?

horsefez — Wed, 20 Jan 2016 15:23:51 GMT

THANKS! This is exactly what I wanted as an answer.
Sadly I'm not able to accept comments as answers, only full postings 😕

Re: How to distribute lookup tables in an indexer clustering environment?

alemarzu — Wed, 20 Jan 2016 20:14:59 GMT

Cool then 😉

Dont worry about it!

Re: How to distribute lookup tables in an indexer clustering environment?

masonmorales — Wed, 20 Jan 2016 20:36:52 GMT

FYI - SH Pooling is deprecated functionality - it still works, but it's not supported.

Re: How to distribute lookup tables in an indexer clustering environment?

masonmorales — Wed, 20 Jan 2016 20:40:40 GMT

Lookup tables typically live on your search head. Since you have a single search head (and not a search head cluster), and you want to push your lookup to the indexers, your best option would be to use a replicated KV store.

Take a look at these docs:

Re: How to distribute lookup tables in an indexer clustering environment?

ppablo — Wed, 20 Jan 2016 21:50:08 GMT

Just converted your comment to an answer @alemarzu 🙂 cheers!

Patrick

Re: How to distribute lookup tables in an indexer clustering environment?

alemarzu — Thu, 21 Jan 2016 12:19:01 GMT

Thank you!