All Apps and Add-ons

How can I sync the CSV lookup files between unclustered search heads?

svemuric
Engager

I have an environment that has 2 different searchheads, on sh1 we will keep changing the auto lookup file and we are also using that same CSV lookup file in sh4. Both are individual searchheads, which are not in a cluster. Is there any way to sync from sh1 to sh4 using a rest call or a scripted way?

0 Karma

masonmorales
Influencer

If your search heads are using Linux, you could look into writing a script that uses rsync to copy them, then create a cron job to automatically run the script periodically.

Also checkout the blog post 493669 mentioned: https://www.splunk.com/blog/2017/06/08/syncing-lookups-using-pure-spl.html

0 Karma

493669
Super Champion

Try this query:

rest splunk_server=sh1 /services/search/jobs/export search="| inputlookup <lookupname.csv> | fillnull value=NULL | rename _* AS tmp_*"\
 output_mode=csv | fields value | rex max_match=0 field=value "(?P<value>^.+)\s" | eval header=mvindex(value,0), value=mvindex(value,1,mvcount(value)) | rex max_match=0 field=header "(?P<header>\"[^\"]+\"|[^,]+)" | mvexpand value | rex max_match=0 field=value "(?P<value>\"[^\"]+\"|[^,]+)" | eval tuple=mvzip(header,value,"#####") | fields tuple | eval primarykey=md5(tostring(tuple)) | mvexpand tuple | rex field=tuple "^(?P<field>.*)#{5}(?P<value>.*)$" | eval field=trim(field,"\""), value=if(value=="NULL","",trim(value,"\"")) | fields primarykey field value | eval {field}=value | fields - name, field, value | stats values(*) as * by primarykey | fields - primarykey | rename tmp_* AS _* | fieldformat _time=if(isint(_time),strftime(_time, "%s"),_time)
iseval = 0

by tihs way you can sync csv lookup files.
reference:https://www.splunk.com/blog/2017/06/08/syncing-lookups-using-pure-spl.html

tomapatan
Communicator

How would this work if the csv file is located in Splunk Cloud and needed to be copied over to our Enterprise SH ? I had a look at the documentation, but couldn`t get it working.

Any help would be greatly appreciated.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...