Deployment Architecture

Why aren't lookups replicating on search head (SH) cluster?

pfabrizi
Path Finder

I have a 3 node SH cluster. I pushed a custom app from the deployer that had a local folder (just a transforms.conf for 2 lookup tables) and I had a folder with 2 lookup tables.

The lookup tables are being pushed to SH's via a crontab running on our Enterprise Security. Since this would get overlaid by a bundle push, I removed the lookup folder from the deployer and re-pushed the bundle.

What I noticed is the lookup tables are not being replicated when they change. I had also noticed that when I removed the folder from the deployer and pushed the bundle, it didn't remove the lookup folder from the 3 SH nodes, which I had expected. My guess is there is something stuck?

Thanks!

0 Karma

gjanders
SplunkTrust
SplunkTrust

Are you pushing files onto the search head and then expecting the replication to just work?

If so you might want to send the lookup files through via a REST API call rather than just scp'ing files to the search head server

0 Karma

chskm
Path Finder

There might be too much size w.r.t. the lookup table, this might be the reason causing not being replicated.
Also, it won't simply remove from the search heads even if you remove from your lookup folder on deployer. There would be a command where it will remove these kind of things from peers, please check with the splunk doc. docs.splunk.com

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...