Getting Data In
Provide Splunk Cloud feedback in this confidential UX survey by June 17
for a chance to win a $200 Amazon gift card!

How to replicate CSV(lookup) from heavy forwarder to Search Head/Indexer?


We are using a clustered environment with indexers,  search-heads, a deployer, and a heavy forwarder (all running on the same Splunk Enterprise version).

We are setting up TA on a heavy forwarder which generates a CSV file(lookup table).

We would like to auto copy/replicate a CSV file from heavy forwarder to search-heads/indexer. Let me know how to achieve this?

Thanks in advance.

Labels (3)
0 Karma


One method is to use rsync (or something similar) to copy the lookup file from the HF to the SH.  The SH will handle pushing the lookup to the indexers as needed.

If this reply helps you, an upvote would be appreciated.
0 Karma

Super Champion

you can index csv file. You can create a saved search to create lookup with the events indexed from the lookup from HF on search Head.

If this helps, give a like below.
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!