Splunk Search

Automatic Lookup local=true

woodams
Engager

We have a large csv file that a user is using with a automatic lookup. The lookup needs only to be stored and searched locally on the single searchhead, but we're getting errors from distributed searchheads about being unable to load the lookup (since it doesn't exist there).

 

In search, you can add local=true which resolves this issue. Is it possible to add this for automatic lookups? I see nothing mentioning it in docs, and the only other community question about this is from 2012 where they say it's not supported... hoping that's changed since then?...

 

If not, what other options do I have?

Labels (1)
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!