Reporting

What Splunk server should contain the lookup tables for all servers to use?

SamHTexas
Builder

What Splunk server should contain the lookup tables for all servers to use?

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If the SH is part of a cluster then, yes, put the lookup file on one of them and the SH will replicate it to others.

If the SHs are not clustered then you'll have to create the lookup on all of them.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

SamHTexas
Builder

Great, so do I create lookup tables only on one SH or all please?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If the SH is part of a cluster then, yes, put the lookup file on one of them and the SH will replicate it to others.

If the SHs are not clustered then you'll have to create the lookup on all of them.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Lookup files are stored on search heads.  They're sent to indexers as part of the search bundle.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...