Automatic Lookup local=true

[woodams]

We have a large csv file that a user is using with a automatic lookup. The lookup needs only to be stored and searched locally on the single searchhead, but we're getting errors from distributed searchheads about being unable to load the lookup (since it doesn't exist there).

In search, you can add local=true which resolves this issue. Is it possible to add this for automatic lookups? I see nothing mentioning it in docs, and the only other community question about this is from 2012 where they say it's not supported... hoping that's changed since then?...

If not, what other options do I have?

[sgbernales]

You have a couple of options.
1) If you have the permissions you can install a custom app that contains the csv in the app's lookups directory. The installation process will push the app to the searchheads as well as the indexers. That should resolve your "idx... lookup not found errors"

2) You can transition the lookup to a kvstore and configure replicate=true in transforms.conf 

replicate = <boolean>
* Indicates whether to replicate this collection on indexers. When false,
  this collection is not replicated on indexers, and lookups that depend on
  this collection are not available (although if you run a lookup command
  with 'local=true', local lookups are available). When true,
  this collection is replicated on indexers.
* Default: false

However there are some default limitations regarding how many results can be returned for a search. Depending on the size of your lookup. But you can review those limitations

here: https://docs.splunk.com/Documentation/Splunk/9.3.0/Admin/Limitsconf#.5Bkvstore.5D

[PickleRick]

Installing an app on SH tier doesn't directly install the same app on indexers. Parts of apps are pushed to indexers as knowledge bundle.

Anyway, back to the original question (which is a bit dated) - if you have an automatic lookup defined, you must have a lookup to back it. All "solutions" in this thread do not limit the scope of the lookup to a single SH but rather distribute the lookup across the whole environment.

[elewis1]

A workaround is Calculated fields can use |eval lookup(). The lookup must be a .csv file on the search head(s).

https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/definecalcfields

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ConditionalFunctions