All Apps and Add-ons

How can I sync the CSV lookup files between unclustered search heads?

svemuric
Engager

I have an environment that has 2 different searchheads, on sh1 we will keep changing the auto lookup file and we are also using that same CSV lookup file in sh4. Both are individual searchheads, which are not in a cluster. Is there any way to sync from sh1 to sh4 using a rest call or a scripted way?

0 Karma

masonmorales
Influencer

If your search heads are using Linux, you could look into writing a script that uses rsync to copy them, then create a cron job to automatically run the script periodically.

Also checkout the blog post 493669 mentioned: https://www.splunk.com/blog/2017/06/08/syncing-lookups-using-pure-spl.html

0 Karma

493669
Super Champion

Try this query:

rest splunk_server=sh1 /services/search/jobs/export search="| inputlookup <lookupname.csv> | fillnull value=NULL | rename _* AS tmp_*"\
 output_mode=csv | fields value | rex max_match=0 field=value "(?P<value>^.+)\s" | eval header=mvindex(value,0), value=mvindex(value,1,mvcount(value)) | rex max_match=0 field=header "(?P<header>\"[^\"]+\"|[^,]+)" | mvexpand value | rex max_match=0 field=value "(?P<value>\"[^\"]+\"|[^,]+)" | eval tuple=mvzip(header,value,"#####") | fields tuple | eval primarykey=md5(tostring(tuple)) | mvexpand tuple | rex field=tuple "^(?P<field>.*)#{5}(?P<value>.*)$" | eval field=trim(field,"\""), value=if(value=="NULL","",trim(value,"\"")) | fields primarykey field value | eval {field}=value | fields - name, field, value | stats values(*) as * by primarykey | fields - primarykey | rename tmp_* AS _* | fieldformat _time=if(isint(_time),strftime(_time, "%s"),_time)
iseval = 0

by tihs way you can sync csv lookup files.
reference:https://www.splunk.com/blog/2017/06/08/syncing-lookups-using-pure-spl.html

tomapatan
Communicator

How would this work if the csv file is located in Splunk Cloud and needed to be copied over to our Enterprise SH ? I had a look at the documentation, but couldn`t get it working.

Any help would be greatly appreciated.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...