Knowledge Management

How to Share Lookup to other SearchHead

jadengoho
Builder

Can i share the output of a lookup command to one search head to another search head. 

This is my Setup for this testing.

2 Search head, 1Cluster Master, and 1 Indexer

Search Heads are not connected to each other.

 Scenario : 

I will run |outputlookup command on the SH1, and  the client want is to share that result to SH2.

I am currently looking at KVStore - i have setup it up (replication=true on collection.conf) , but the lookup is not  showing on the SH2.

 

Labels (2)
Tags (2)
0 Karma
1 Solution

gjanders
SplunkTrust
SplunkTrust

The fact that they are using the same indexer will not help, if it's a kvstore the TA-SyncKVStore app on SplunkBase might help

If they are using CSV you could use the WebTools Add On to query the "other" instance and output a lookup (the syntax will get tricky to get the output right but it's possible)

Also you can refer to the older blog post Syncing Lookups Using Pure SPL

 

View solution in original post

0 Karma

FrankVl
Ultra Champion

If the search heads are not part of a search head cluster, they will not be aware of each other's knowledge objects (like lookups/ kv-store collections / ...).

I can think of a few ways to make the content of a lookup available on another search head:

  1. Write the data also to a (summary) index. Run a scheduled search on the other search head to fetch data from the index and populate a local copy of the lookup.
  2. Define the same csv file based lookup on both search heads and use some mechanism to sync the underlying csv file between the search heads (e.g. a scheduled rsync job).
  3. Similar to option 2, but use a script that talks to the REST interface of both search heads to sync the lookup contents (not an expert on this, but I think this should be possible)

But it might also be a good reason to think about moving to a clustered search head setup.

0 Karma

jadengoho
Builder

They don't want using  summary indexing, that is why im looking for other possibilities to get this through.

Is it possible to share the KVSTORE lookup/csv file using indexer ? since they are using similar indexer.

0 Karma

gjanders
SplunkTrust
SplunkTrust

The fact that they are using the same indexer will not help, if it's a kvstore the TA-SyncKVStore app on SplunkBase might help

If they are using CSV you could use the WebTools Add On to query the "other" instance and output a lookup (the syntax will get tricky to get the output right but it's possible)

Also you can refer to the older blog post Syncing Lookups Using Pure SPL

 

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...