Knowledge Management

How to Share Lookup to other SearchHead

jadengoho
Builder

Can i share the output of a lookup command to one search head to another search head. 

This is my Setup for this testing.

2 Search head, 1Cluster Master, and 1 Indexer

Search Heads are not connected to each other.

 Scenario : 

I will run |outputlookup command on the SH1, and  the client want is to share that result to SH2.

I am currently looking at KVStore - i have setup it up (replication=true on collection.conf) , but the lookup is not  showing on the SH2.

 

Labels (2)
Tags (2)
0 Karma
1 Solution

gjanders
SplunkTrust
SplunkTrust

The fact that they are using the same indexer will not help, if it's a kvstore the kvstore tools redux app on SplunkBase might help

If they are using CSV you could use the WebTools Add On to query the "other" instance and output a lookup (the syntax will get tricky to get the output right but it's possible)

Also you can refer to the older blog post Syncing Lookups Using Pure SPL

 

 

 

 

 

 

 

 

 

 

View solution in original post

FrankVl
Ultra Champion

If the search heads are not part of a search head cluster, they will not be aware of each other's knowledge objects (like lookups/ kv-store collections / ...).

I can think of a few ways to make the content of a lookup available on another search head:

  1. Write the data also to a (summary) index. Run a scheduled search on the other search head to fetch data from the index and populate a local copy of the lookup.
  2. Define the same csv file based lookup on both search heads and use some mechanism to sync the underlying csv file between the search heads (e.g. a scheduled rsync job).
  3. Similar to option 2, but use a script that talks to the REST interface of both search heads to sync the lookup contents (not an expert on this, but I think this should be possible)

But it might also be a good reason to think about moving to a clustered search head setup.

0 Karma

jadengoho
Builder

They don't want using  summary indexing, that is why im looking for other possibilities to get this through.

Is it possible to share the KVSTORE lookup/csv file using indexer ? since they are using similar indexer.

0 Karma

gjanders
SplunkTrust
SplunkTrust

The fact that they are using the same indexer will not help, if it's a kvstore the kvstore tools redux app on SplunkBase might help

If they are using CSV you could use the WebTools Add On to query the "other" instance and output a lookup (the syntax will get tricky to get the output right but it's possible)

Also you can refer to the older blog post Syncing Lookups Using Pure SPL

 

 

 

 

 

 

 

 

 

 

Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...