Splunk Search

How to get that file to be replicated to the other search heads?

umd06
Engager

I have a cron job that creates a lookup file under $splunkhome$/etc/apps/search/lookups on one of the search heads. How do I get that file to be replicated to the other search heads? 

I've created a lookup definition for it and it works great the first time, but after the file's been updated. The new results are only available on the local sheard head. 

Labels (1)
0 Karma

yeahnah
Motivator

Hi @umd06 

You have not specified whether it is a search head cluster (SHC) or not.  An SHC should automatically replicate lookups between its SHC members.  If it isn't, you may have a replication issue.  Check the _internal logs for issues.

For standalone search heads, there is no auto mechanism to replicate lookups to other standalone search heads. 

0 Karma
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...