How to Share Lookup to other SearchHead

[jadengoho]

Can i share the output of a lookup command to one search head to another search head. 

This is my Setup for this testing.

2 Search head, 1Cluster Master, and 1 Indexer

Search Heads are not connected to each other.

 Scenario : 

I will run |outputlookup command on the SH1, and  the client want is to share that result to SH2.

I am currently looking at KVStore - i have setup it up (replication=true on collection.conf) , but the lookup is not  showing on the SH2.

[FrankVl]

If the search heads are not part of a search head cluster, they will not be aware of each other's knowledge objects (like lookups/ kv-store collections / ...).

I can think of a few ways to make the content of a lookup available on another search head:

1. Write the data also to a (summary) index. Run a scheduled search on the other search head to fetch data from the index and populate a local copy of the lookup.
2. Define the same csv file based lookup on both search heads and use some mechanism to sync the underlying csv file between the search heads (e.g. a scheduled rsync job).
3. Similar to option 2, but use a script that talks to the REST interface of both search heads to sync the lookup contents (not an expert on this, but I think this should be possible)

But it might also be a good reason to think about moving to a clustered search head setup.

[jadengoho]

They don't want using  summary indexing, that is why im looking for other possibilities to get this through.

Is it possible to share the KVSTORE lookup/csv file using indexer ? since they are using similar indexer.

[gjanders · Accepted solution]

The fact that they are using the same indexer will not help, if it's a kvstore the kvstore tools redux app on SplunkBase might help

If they are using CSV you could use the WebTools Add On to query the "other" instance and output a lookup (the syntax will get tricky to get the output right but it's possible)

Also you can refer to the older blog post Syncing Lookups Using Pure SPL