Getting Data In

How to replicate CSV(lookup) from heavy forwarder to Search Head/Indexer?

mbachhav
Path Finder

We are using a clustered environment with indexers,  search-heads, a deployer, and a heavy forwarder (all running on the same Splunk Enterprise version).

We are setting up TA on a heavy forwarder which generates a CSV file(lookup table).

We would like to auto copy/replicate a CSV file from heavy forwarder to search-heads/indexer. Let me know how to achieve this?

Thanks in advance.

Labels (3)
0 Karma

nmohammed
Contributor

@mbachhav - did you get this done ? I am running into similar challenge and thinking best way of getting this from HF to SHC/Indexer 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

One method is to use rsync (or something similar) to copy the lookup file from the HF to the SH.  The SH will handle pushing the lookup to the indexers as needed.

---
If this reply helps you, Karma would be appreciated.
0 Karma

thambisetty
SplunkTrust
SplunkTrust

you can index csv file. You can create a saved search to create lookup with the events indexed from the lookup from HF on search Head.

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...