Getting Data In

App local files updated in indexer cluster

Path Finder

I have an app which included a custom command which in turn has to cache some information on the indexer it runs. What is the best location to store this file, is $SPLUNK_HOME/etc/apps/<appname>/lookups/<my_cache_file_name>.cache sensible?
What will the indexer cluster do with this files?

Just in case you wonder, the caches are to large to distribute them with the replication bundle as a lookup table.  They are filled by reading the kvstore from the calling search head with REST calls.

Labels (1)
0 Karma

As you should install this by CM then the correct place will be SPLUNK_HOME/etc/slave-apps/... instead of apps.
r. Ismo
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...