Splunk Search

Clustered search heads broke lookup tables where do I reupload the lookups?

rtalcik
Path Finder

Hi All,

so i clustered my search heads and added them to my index cluster. However it broke all my lookup tables. I took a backup of /opt/splunk/etc before I did this on the search head with all the lookups.

I guess my question is, is this as simple as just pasting the old lookups into the lookup /system/lookups/

IF SO, where do i do this on? the mgmt_uri? or the captain search head?

if not? can you paste a doc to follow?

0 Karma

codebuilder
Influencer

You'll need use the deployer to distribute your lookups if you want them to replicate across the SHC.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...