Can CORE Search function Like ES

[pfabrizi]

In our DEV space we are running a single search head with ES installed. We have built identity lookups from our HR data and AD. As we migrate to production we will have 3 node SH cluster and a ES Search head building our lookups. We will use CIM for normalization. If I want to move those lookups to our 3 Node SH cluster I know I can move the .CSV files, but is the normalization available on a NON ES Search Head?

Thanks!

[smoir_splunk]

CIM is its own app and can be installed and used anywhere you want to. https://splunkbase.splunk.com/app/1621/