Hi All,
so i clustered my search heads and added them to my index cluster. However it broke all my lookup tables. I took a backup of /opt/splunk/etc before I did this on the search head with all the lookups.
I guess my question is, is this as simple as just pasting the old lookups into the lookup /system/lookups/
IF SO, where do i do this on? the mgmt_uri? or the captain search head?
if not? can you paste a doc to follow?
You'll need use the deployer to distribute your lookups if you want them to replicate across the SHC.