How can I sync the CSV lookup files between unclustered search heads?

[svemuric]

I have an environment that has 2 different searchheads, on sh1 we will keep changing the auto lookup file and we are also using that same CSV lookup file in sh4. Both are individual searchheads, which are not in a cluster. Is there any way to sync from sh1 to sh4 using a rest call or a scripted way?

[masonmorales]

If your search heads are using Linux, you could look into writing a script that uses rsync to copy them, then create a cron job to automatically run the script periodically.

Also checkout the blog post 493669 mentioned: https://www.splunk.com/blog/2017/06/08/syncing-lookups-using-pure-spl.html

[493669]

Try this query:

rest splunk_server=sh1 /services/search/jobs/export search="| inputlookup <lookupname.csv> | fillnull value=NULL | rename _* AS tmp_*"\
 output_mode=csv | fields value | rex max_match=0 field=value "(?P<value>^.+)\s" | eval header=mvindex(value,0), value=mvindex(value,1,mvcount(value)) | rex max_match=0 field=header "(?P<header>\"[^\"]+\"|[^,]+)" | mvexpand value | rex max_match=0 field=value "(?P<value>\"[^\"]+\"|[^,]+)" | eval tuple=mvzip(header,value,"#####") | fields tuple | eval primarykey=md5(tostring(tuple)) | mvexpand tuple | rex field=tuple "^(?P<field>.*)#{5}(?P<value>.*)$" | eval field=trim(field,"\""), value=if(value=="NULL","",trim(value,"\"")) | fields primarykey field value | eval {field}=value | fields - name, field, value | stats values(*) as * by primarykey | fields - primarykey | rename tmp_* AS _* | fieldformat _time=if(isint(_time),strftime(_time, "%s"),_time)
iseval = 0

by tihs way you can sync csv lookup files.
reference:https://www.splunk.com/blog/2017/06/08/syncing-lookups-using-pure-spl.html

[tomapatan]

How would this work if the csv file is located in Splunk Cloud and needed to be copied over to our Enterprise SH ? I had a look at the documentation, but couldn`t get it working.

Any help would be greatly appreciated.