Splunk Search

Automatic Lookup local=true


We have a large csv file that a user is using with a automatic lookup. The lookup needs only to be stored and searched locally on the single searchhead, but we're getting errors from distributed searchheads about being unable to load the lookup (since it doesn't exist there).


In search, you can add local=true which resolves this issue. Is it possible to add this for automatic lookups? I see nothing mentioning it in docs, and the only other community question about this is from 2012 where they say it's not supported... hoping that's changed since then?...


If not, what other options do I have?

Labels (1)
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>