Deployment Architecture

Why aren't lookups replicating on search head (SH) cluster?

pfabrizi
Path Finder

I have a 3 node SH cluster. I pushed a custom app from the deployer that had a local folder (just a transforms.conf for 2 lookup tables) and I had a folder with 2 lookup tables.

The lookup tables are being pushed to SH's via a crontab running on our Enterprise Security. Since this would get overlaid by a bundle push, I removed the lookup folder from the deployer and re-pushed the bundle.

What I noticed is the lookup tables are not being replicated when they change. I had also noticed that when I removed the folder from the deployer and pushed the bundle, it didn't remove the lookup folder from the 3 SH nodes, which I had expected. My guess is there is something stuck?

Thanks!

0 Karma

gjanders
SplunkTrust
SplunkTrust

Are you pushing files onto the search head and then expecting the replication to just work?

If so you might want to send the lookup files through via a REST API call rather than just scp'ing files to the search head server

0 Karma

chskm
Path Finder

There might be too much size w.r.t. the lookup table, this might be the reason causing not being replicated.
Also, it won't simply remove from the search heads even if you remove from your lookup folder on deployer. There would be a command where it will remove these kind of things from peers, please check with the splunk doc. docs.splunk.com

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...