Splunk Search

Automatic Lookup local=true

woodams
Explorer

We have a large csv file that a user is using with a automatic lookup. The lookup needs only to be stored and searched locally on the single searchhead, but we're getting errors from distributed searchheads about being unable to load the lookup (since it doesn't exist there).

 

In search, you can add local=true which resolves this issue. Is it possible to add this for automatic lookups? I see nothing mentioning it in docs, and the only other community question about this is from 2012 where they say it's not supported... hoping that's changed since then?...

 

If not, what other options do I have?

Labels (1)
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...