We are using a clustered environment with indexers, search-heads, a deployer, and a heavy forwarder (all running on the same Splunk Enterprise version).
We are setting up TA on a heavy forwarder which generates a CSV file(lookup table).
We would like to auto copy/replicate a CSV file from heavy forwarder to search-heads/indexer. Let me know how to achieve this?
Thanks in advance.
One method is to use rsync (or something similar) to copy the lookup file from the HF to the SH. The SH will handle pushing the lookup to the indexers as needed.
you can index csv file. You can create a saved search to create lookup with the events indexed from the lookup from HF on search Head.