Is there a way to propagate dbquery result to all search heads?

[joeldavideng]

I am running a daily query against an external database that provides a list of assets that many of my searches utilize. The searches exist on multiple search heads and I would like to avoid having to install DB Connect on all of them and replicate the expensive search. Is there a way to have the query run once on a centralized node and then have the others pull this list on a daily basis without having to use the deployment server?

[starcher · Accepted solution]

Run DBX on a heavy forwarder. Have your query send to a kvstore lookup on the target SHs or SHC using the alert action in: https://splunkbase.splunk.com/app/3519/

[joeldavideng]

This app is fire. Thanks a lot!