How to replicate CSV(lookup) from heavy forwarder to Search Head/Indexer?

[mbachhav]

We are using a clustered environment with indexers,  search-heads, a deployer, and a heavy forwarder (all running on the same Splunk Enterprise version).

We are setting up TA on a heavy forwarder which generates a CSV file(lookup table).

We would like to auto copy/replicate a CSV file from heavy forwarder to search-heads/indexer. Let me know how to achieve this?

Thanks in advance.

[nmohammed]

@mbachhav - did you get this done ? I am running into similar challenge and thinking best way of getting this from HF to SHC/Indexer 

[richgalloway]

One method is to use rsync (or something similar) to copy the lookup file from the HF to the SH.  The SH will handle pushing the lookup to the indexers as needed.

[thambisetty]

you can index csv file. You can create a saved search to create lookup with the events indexed from the lookup from HF on search Head.