Getting Data In

How to replicate CSV(lookup) from heavy forwarder to Search Head/Indexer?

Path Finder

We are using a clustered environment with indexers,  search-heads, a deployer, and a heavy forwarder (all running on the same Splunk Enterprise version).

We are setting up TA on a heavy forwarder which generates a CSV file(lookup table).

We would like to auto copy/replicate a CSV file from heavy forwarder to search-heads/indexer. Let me know how to achieve this?

Thanks in advance.

Labels (3)
0 Karma


One method is to use rsync (or something similar) to copy the lookup file from the HF to the SH.  The SH will handle pushing the lookup to the indexers as needed.

If this reply helps you, an upvote would be appreciated.
0 Karma

Super Champion

you can index csv file. You can create a saved search to create lookup with the events indexed from the lookup from HF on search Head.

If this helps, give a like below.
0 Karma