Hi Splunkers,
I'm testing with 2 separated splunk deployments, 1 is provider and 1 is local.
I want to put lookup file/definition or a kvstore on the local, when make a search to the provider (via standard mode or transparent) then `lookup` in the local LookupDefinition.
How can I do it? Or please some one explain me this context.
I looked around about lookup command, federated.conf, transform.conf, distsearch.conf...
My search like:
```
<base search>
| fields srcip, dstip
| lookup local=true serversList ip as srcip OUTPUTNEW serverName
```
