Getting Data In

Where to keep the lookup file in a clustered environment



We are moving from single deployment to clustered environment. 

Current scenario: for one of my dashboards i was getting the lookup file created by running a python script. using a cronjob. Since i dont want it to be indexed, i was just creating the file and placing it in the lookups folder of one of the apps where the dashboard is there. 

Now when i move to clustered environment how and where do i place the script to generate the lookup 

and where can i save the lookup file to automatically get shared in all the searh heads. 



Labels (2)
Tags (1)
0 Karma


Hi @surekhasplunk,

Since Splunk Search Head Cluster will not detect changes you make without Web UI or REST, you have two options;

1- You can create a custom search command runs your python script and than pipe to outputlookup. With this way the cluster will replicate lookup across members.  

2- Running python script on every search head with cronjob.


If this reply helps you an upvote is appreciated.
0 Karma


Hello @scelikok 

Thank you so much for your reply. 

for 1st point, if you could you please give an example snippet, that would be great


0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...