I have an app which included a custom command which in turn has to cache some information on the indexer it runs. What is the best location to store this file, is $SPLUNK_HOME/etc/apps/<appname>/lookups/<my_cache_file_name>.cache sensible?
What will the indexer cluster do with this files?
Just in case you wonder, the caches are to large to distribute them with the replication bundle as a lookup table. They are filled by reading the kvstore from the calling search head with REST calls.
