Deployment Architecture

creating a lookup with search-head pooling



We just implemented search-head pooling. I have a lookup that gets generated via wget. How do people handle situations like this? I don't want to tie the scripts to a specific server, but I also want to make sure it runs when one of the servers is down. Is there a way to have Splunk run it, but not generate indexed data?

0 Karma

Splunk Employee
Splunk Employee

One option: create a Python search command that updates your lookup. Then, schedule a search that invokes that search command on a desired interval (e.g. every night at midnight). The search heads in your pool will coordinate such that only one instance runs the scheduled search "at a time" (i.e. only one instance in the pool will run the scheduled search, per interval).

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...