Is it possible to populate lookups in a SHC from a Heavy Forwarder

[brettcave]

I am using an app that pulls data from a provider (aws). Our current setup is as follows:

1. App is installed on a heavy forwarder. The HF is configured with authentication to AWS, and can pull it's data. HF collects AWS datas and forwards to indexer.
2. Indexer has the app for required indexing (transforms, props, etc).
3. SHC has the app installed for reports / dashboards / searches and alerts.

Most of the app works fine, but 1 thing that isn't working is lookups. There is a search that populates the lookup that gets scheduled. Running the search on HF doesn't work, it throws an error (but i dont think that trying to populate the lookup on the HF is right). I can run the command that populates the lookup on the SHC, but it doesn't return any results: the custom command executes AWS API calls, but the SHCs are authorized to make API calls. Is there a way to retrieve the data via the HF and then populate it into the lookup in the SHC some how? Or would I need to authorize the SHC to AWS?

[skalliger]

If you're using a modular input, the HF can do that just fine. Do the API call, index the output, write a search (report) on your SHC to populate the lookup based on the indexed data, make sure to define a lookup definition as well. Share that definition (app/global). Should be working.