I have a cron job that creates a lookup file under $splunkhome$/etc/apps/search/lookups on one of the search heads. How do I get that file to be replicated to the other search heads?
I've created a lookup definition for it and it works great the first time, but after the file's been updated. The new results are only available on the local sheard head.
Hi @umd06
You have not specified whether it is a search head cluster (SHC) or not. An SHC should automatically replicate lookups between its SHC members. If it isn't, you may have a replication issue. Check the _internal logs for issues.
For standalone search heads, there is no auto mechanism to replicate lookups to other standalone search heads.