Deployment Architecture

Is it possible to populate lookups in a SHC from a Heavy Forwarder


I am using an app that pulls data from a provider (aws). Our current setup is as follows:

  1. App is installed on a heavy forwarder. The HF is configured with authentication to AWS, and can pull it's data. HF collects AWS datas and forwards to indexer.
  2. Indexer has the app for required indexing (transforms, props, etc).
  3. SHC has the app installed for reports / dashboards / searches and alerts.

Most of the app works fine, but 1 thing that isn't working is lookups. There is a search that populates the lookup that gets scheduled. Running the search on HF doesn't work, it throws an error (but i dont think that trying to populate the lookup on the HF is right). I can run the command that populates the lookup on the SHC, but it doesn't return any results: the custom command executes AWS API calls, but the SHCs are authorized to make API calls. Is there a way to retrieve the data via the HF and then populate it into the lookup in the SHC some how? Or would I need to authorize the SHC to AWS?

Tags (1)
0 Karma


If you're using a modular input, the HF can do that just fine. Do the API call, index the output, write a search (report) on your SHC to populate the lookup based on the indexed data, make sure to define a lookup definition as well. Share that definition (app/global). Should be working.

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...