Deployment Architecture

How can I have the auto db-lookups in distributed environment?

Path Finder

I am aware that the auto-lookup functionality is not supported with db-lookups, due to constrain of running the db-lookup locally only on the search head.

Example - index=test | lookup local=1 mysql_table ip_address as clientip OUTPUT host | table clientip, host

Which is not achievable with auto-lookup.

Is there any work-around to this ?
Can I install db-connect app on the indexers as well and have the streaming db-lookup running on both the instances, indexers + search head ?

Using distributed environment (1 HFWD, 2 IDX, 1 SH), on Splunk 6.0.4 (build 207768), dbx 1.1.6. Any help is appreciated! Thanks!


hi i'm try to solve this probleme

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...