Knowledge Management

How to Share Lookup to other SearchHead

jadengoho
Builder

Can i share the output of a lookup command to one search head to another search head. 

This is my Setup for this testing.

2 Search head, 1Cluster Master, and 1 Indexer

Search Heads are not connected to each other.

 Scenario : 

I will run |outputlookup command on the SH1, and  the client want is to share that result to SH2.

I am currently looking at KVStore - i have setup it up (replication=true on collection.conf) , but the lookup is not  showing on the SH2.

 

Labels (2)
Tags (2)
0 Karma
1 Solution

gjanders
SplunkTrust
SplunkTrust

The fact that they are using the same indexer will not help, if it's a kvstore the TA-SyncKVStore app on SplunkBase might help

If they are using CSV you could use the WebTools Add On to query the "other" instance and output a lookup (the syntax will get tricky to get the output right but it's possible)

Also you can refer to the older blog post Syncing Lookups Using Pure SPL

 

View solution in original post

0 Karma

FrankVl
Ultra Champion

If the search heads are not part of a search head cluster, they will not be aware of each other's knowledge objects (like lookups/ kv-store collections / ...).

I can think of a few ways to make the content of a lookup available on another search head:

  1. Write the data also to a (summary) index. Run a scheduled search on the other search head to fetch data from the index and populate a local copy of the lookup.
  2. Define the same csv file based lookup on both search heads and use some mechanism to sync the underlying csv file between the search heads (e.g. a scheduled rsync job).
  3. Similar to option 2, but use a script that talks to the REST interface of both search heads to sync the lookup contents (not an expert on this, but I think this should be possible)

But it might also be a good reason to think about moving to a clustered search head setup.

0 Karma

jadengoho
Builder

They don't want using  summary indexing, that is why im looking for other possibilities to get this through.

Is it possible to share the KVSTORE lookup/csv file using indexer ? since they are using similar indexer.

0 Karma

gjanders
SplunkTrust
SplunkTrust

The fact that they are using the same indexer will not help, if it's a kvstore the TA-SyncKVStore app on SplunkBase might help

If they are using CSV you could use the WebTools Add On to query the "other" instance and output a lookup (the syntax will get tricky to get the output right but it's possible)

Also you can refer to the older blog post Syncing Lookups Using Pure SPL

 

0 Karma
Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...